@@ -, +, @@ in user It is possible to cancel reservations through simply running opac-modreserve.pl with existing reserve_id number. This may provide remove even all reservations from system. The only limitation is that user have to be logged in. Simplest solution is to check whether reserve belongs to user or not. --- opac/opac-modrequest.pl | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/opac/opac-modrequest.pl +++ a/opac/opac-modrequest.pl @@ -45,7 +45,9 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( my $reserve_id = $query->param('reserve_id'); if ($reserve_id && $borrowernumber) { - CancelReserve({ reserve_id => $reserve_id }); + + my $reserve = GetReserve($reserve_id); + CancelReserve({ reserve_id => $reserve_id }) if $borrowernumber == $reserve->{borrowernumber} ; } print $query->redirect("/cgi-bin/koha/opac-user.pl#opac-user-holds"); --