Bug 30732 - Librarians with only "place_holds" permission can not suspend and resume holds
Summary: Librarians with only "place_holds" permission can not suspend and resume holds
Status: Failed QA
Alias: None
Product: Koha
Classification: Unclassified
Component: Hold requests (show other bugs)
Version: 21.05
Hardware: All All
: P5 - low major (vote)
Assignee: Kyle M Hall
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-05-11 13:49 UTC by Kyle M Hall
Modified: 2022-09-27 10:59 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 30732: Librarians with only "place_holds" permission can not suspend and resume holds (1.29 KB, patch)
2022-05-11 13:56 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 30732: Librarians with only "place_holds" permission can not suspend and resume holds (1.30 KB, patch)
2022-09-13 10:32 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 30732: Librarians with only "place_holds" permission can not suspend and resume holds (1.35 KB, patch)
2022-09-13 18:31 UTC, David Nind
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Kyle M Hall 2022-05-11 13:49:33 UTC
If a librarian only has the place_holds permission, they can see the buttons for placing and suspending holds on moremember.pl and circulation.pl, but cannot use them.
Comment 1 Kyle M Hall 2022-05-11 13:56:52 UTC
Created attachment 134895 [details] [review]
Bug 30732: Librarians with only "place_holds" permission can not suspend and resume holds

If a librarian only has the place_holds permission, they can see the buttons for placing and suspending holds on moremember.pl and circulation.pl, but cannot use them.

Test Plan:
1) Give your librian only the place_holds permission
2) Attempt to suspend and resume holds on moremember.pl and
   circulation.pl
3) Note you cannot
4) Apply this patch
5) Restart all the things!
6) Test again, note you can now suspend and resume holds!
Comment 2 Sally 2022-05-16 10:59:02 UTC
Sorry, Kyle, I can't get this to work - I restarted services before testing.

- I set up a hold and suspended it
- I logged into a limited staff account with only place_hold permission
- I tried to resume the hold and on both pages got, "Your request could not be processed.  Check the logs."
- I logged back in as the superlibrarian account and resumed the hold
- I logged back into the staff account (with only place_hold permission)
- I tried to suspend the hold - this time I got the suspension date box, but any attempt to suspend it (with or without a date) caused the, "Your request could not be processed.  Check the logs." error to show.

I cleared the hold and placed a new one via the limited staff account, but the same error occurred.

I also wondered if it was a cache thing, so as well as clearing the cache, I tried in a different browser - but no joy.
Comment 3 Fridolin Somers 2022-09-12 20:39:47 UTC
I rise to Major because this can be a daily issue for librarians.

Bug 30207 is pushed so we would like this one should go forward.
Comment 4 Kyle M Hall 2022-09-13 10:32:33 UTC
Created attachment 140562 [details] [review]
Bug 30732: Librarians with only "place_holds" permission can not suspend and resume holds

If a librarian only has the place_holds permission, they can see the buttons for placing and suspending holds on moremember.pl and circulation.pl, but cannot use them.

Test Plan:
1) Give your librian only the place_holds permission
2) Attempt to "suspend all" and "resume all" holds on moremember.pl and
   circulation.pl
3) Note you cannot
4) Apply this patch
5) Restart all the things!
6) Test again, note you can now suspend and resume holds!
Comment 5 Kyle M Hall 2022-09-13 10:35:22 UTC
I've amended by test plan! I should have wrote to use the "all" versions of the suspend and resume buttons!
Comment 6 David Nind 2022-09-13 18:31:48 UTC
Created attachment 140601 [details] [review]
Bug 30732: Librarians with only "place_holds" permission can not suspend and resume holds

If a librarian only has the place_holds permission, they can see the buttons for placing and suspending holds on moremember.pl and circulation.pl, but cannot use them.

Test Plan:
1) Give your librian only the place_holds permission
2) Attempt to "suspend all" and "resume all" holds on moremember.pl and
   circulation.pl
3) Note you cannot
4) Apply this patch
5) Restart all the things!
6) Test again, note you can now suspend and resume holds!

Signed-off-by: David Nind <david@davidnind.com>
Comment 7 Katrin Fischer 2022-09-26 20:57:49 UTC
With * this will work with either, place_holds and modify_holds_priority permission, not only with place_holds.

Was this the intended behaviour?

Also: if you have neither, you can still see the buttons. We should add permission checks there as well, so people don't get into the situation in the first place where they get stuck on missing permissions (could be a separate bug).
Comment 8 Kyle M Hall 2022-09-27 10:59:06 UTC
(In reply to Katrin Fischer from comment #7)
> With * this will work with either, place_holds and modify_holds_priority
> permission, not only with place_holds.
> 
> Was this the intended behaviour?
> 
> Also: if you have neither, you can still see the buttons. We should add
> permission checks there as well, so people don't get into the situation in
> the first place where they get stuck on missing permissions (could be a
> separate bug).

Indeed. I think the solution is hide the button unless the patron has place_holds. We can just set the script permission to be for place_holds too, right? If you think that's a good course of action Katrin, I will make those changes.