Bug 35053 - Item-level rules not checked if both item_id and biblio_id are passed
Summary: Item-level rules not checked if both item_id and biblio_id are passed
Status: Pushed to oldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: REST API (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Tomás Cohen Arazi
QA Contact:
URL:
Keywords:
: 33477 (view as bug list)
Depends on:
Blocks:
 
Reported: 2023-10-13 19:30 UTC by Nick Clemens (kidclamp)
Modified: 2023-11-28 15:16 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.11.00,23.05.05,22.11.12


Attachments
Bug 35053: Regression tests (2.29 KB, patch)
2023-10-17 12:12 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 35053: Make sure request is checked as an item-level request if item_id passed (1.96 KB, patch)
2023-10-17 12:12 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 35053: Regression tests (2.34 KB, patch)
2023-10-19 07:26 UTC, David Nind
Details | Diff | Splinter Review
Bug 35053: Make sure request is checked as an item-level request if item_id passed (2.00 KB, patch)
2023-10-19 07:26 UTC, David Nind
Details | Diff | Splinter Review
Bug 35053: Regression tests (2.39 KB, patch)
2023-10-19 11:57 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 35053: Make sure request is checked as an item-level request if item_id passed (2.06 KB, patch)
2023-10-19 11:57 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens (kidclamp) 2023-10-13 19:30:01 UTC
In the checks we have:

if ( $item_id and $biblio_id ) {
....
   $biblio = Koha::Biblios->find($biblio_id);
...
}

$item does not get assigned, then later:

            my $can_place_hold
                = $item
                ? C4::Reserves::CanItemBeReserved( $patron, $item )
                : C4::Reserves::CanBookBeReserved( $patron_id, $biblio_id );

So while the item may not be holdable, we check if the bib is, then place the hold using the item_id
Comment 1 Tomás Cohen Arazi 2023-10-17 12:12:02 UTC
Created attachment 157231 [details] [review]
Bug 35053: Regression tests
Comment 2 Tomás Cohen Arazi 2023-10-17 12:12:05 UTC
Created attachment 157232 [details] [review]
Bug 35053: Make sure request is checked as an item-level request if item_id passed

This patch makes the validation code have the `$item` variable defined
when checking holdability, in the case both `item_id` and `biblio_id`
params are passed.

Otherwise, if the requested item is not holdable, but a biblio-level
hold *could* be placed, the item-level hold is placed.

This is highlighted by the regression tests.

To test:
1. Apply the regression tests patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/holds.t
=> FAIL: Tests don't pass. A request that should be rejected is allowed
because biblio-level hold is allowed.
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass! Item-level rules are checked and thus the
request rejected (code 403)
5. Sign off :-D
Comment 3 David Nind 2023-10-19 07:26:30 UTC
Created attachment 157389 [details] [review]
Bug 35053: Regression tests

Signed-off-by: David Nind <david@davidnind.com>
Comment 4 David Nind 2023-10-19 07:26:32 UTC
Created attachment 157390 [details] [review]
Bug 35053: Make sure request is checked as an item-level request if item_id passed

This patch makes the validation code have the `$item` variable defined
when checking holdability, in the case both `item_id` and `biblio_id`
params are passed.

Otherwise, if the requested item is not holdable, but a biblio-level
hold *could* be placed, the item-level hold is placed.

This is highlighted by the regression tests.

To test:
1. Apply the regression tests patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/holds.t
=> FAIL: Tests don't pass. A request that should be rejected is allowed
because biblio-level hold is allowed.
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass! Item-level rules are checked and thus the
request rejected (code 403)
5. Sign off :-D

Signed-off-by: David Nind <david@davidnind.com>
Comment 5 Nick Clemens (kidclamp) 2023-10-19 11:57:25 UTC
Created attachment 157424 [details] [review]
Bug 35053: Regression tests

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 6 Nick Clemens (kidclamp) 2023-10-19 11:57:27 UTC
Created attachment 157425 [details] [review]
Bug 35053: Make sure request is checked as an item-level request if item_id passed

This patch makes the validation code have the `$item` variable defined
when checking holdability, in the case both `item_id` and `biblio_id`
params are passed.

Otherwise, if the requested item is not holdable, but a biblio-level
hold *could* be placed, the item-level hold is placed.

This is highlighted by the regression tests.

To test:
1. Apply the regression tests patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/holds.t
=> FAIL: Tests don't pass. A request that should be rejected is allowed
because biblio-level hold is allowed.
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass! Item-level rules are checked and thus the
request rejected (code 403)
5. Sign off :-D

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 7 Tomás Cohen Arazi 2023-10-20 14:04:03 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 8 Fridolin Somers 2023-10-25 21:48:11 UTC
Pushed to 23.05.x for 23.05.05
Comment 9 Matt Blenkinsop 2023-11-13 14:03:33 UTC
Nice work everyone!

Pushed to oldstable for 22.11.x
Comment 10 Emily Lamancusa 2023-11-28 15:16:16 UTC
*** Bug 33477 has been marked as a duplicate of this bug. ***