From 5e7dbc436bafd4945c2ae3d459830fd2c4045986 Mon Sep 17 00:00:00 2001
From: Arthur Suzuki <arthur.suzuki@biblibre.com>
Date: Wed, 20 Feb 2019 21:15:44 +0100
Subject: [PATCH] Bug 22379 : Fix checks not made by ILS-DI method CancelHold

Disable the possibility for a borrower to cancel a reservation
which is either in a Transit or Waiting state.
This reproduce the behaviour seen on the OPAC.
Also replaces previous checks on the borrowernumber
since CanReserveBeCanceledFromOpac already checks this.

--------------------------------

Test plan (before patch) :
-Put a reserve for a borrower
-Try to cancel the reserve providing another borrowernumber as argument
	-> Should fail and reply "RecordNotFound"
	-> Reserve still appears in the list of holds.

-Try to cancel the reserve providing the borrowernumber the reserve is
for.
	-> Should succeed, reply with "Canceled"
	-> Reserve do not show up in the list of holds for the borrower

-Put a new reserve with a pickup branch != from the homebranch
-Transfer the item to the pickup branch (reserve status = Transit)
-Try to cancel the reserve (with proper borrowernumber)
	-> Should succeed, reply with "Canceled"
	-> Reserve do not show up in the list of holds for the borrower

-Checkout the reserved item in the pickup branch (reserve status =
Waiting)
-Try to cancel the reserve (with proper borrowernumber)
	-> Should succeed, reply with "Canceled"
	-> Reserve do not show up in the list of holds for the borrower

--------------------------------

Test plan (after patch) :
-Put a reserve for a borrower
-Try to cancel the reserve providing another borrowernumber as argument
	-> Should fail and reply "BorrowerCannotCancelHold"
	-> Reserve still appears in the list of holds.

-Try to cancel the reserve providing the borrowernumber the reserve is
for.
	-> Should succeed, reply with "Canceled"
	-> Reserve do not show up in the list of holds for the borrower

-Put a new reserve with a pickup branch != from the homebranch
-Transfer the item to the pickup branch (reserve status = Transit)
-Try to cancel the reserve (with proper borrowernumber)
	-> Should fail and reply "BorrowerCannotCancelHold"
	-> Reserve still appears in the list of holds.

-Checkout the reserved item in the pickup branch (reserve status =
Waiting)
-Try to cancel the reserve (with proper borrowernumber)
	-> Should fail and reply "BorrowerCannotCancelHold"
	-> Reserve still appears in the list of holds.
---
 C4/ILSDI/Services.pm | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/C4/ILSDI/Services.pm b/C4/ILSDI/Services.pm
index 1ffdc14419..afe3ca772e 100644
--- a/C4/ILSDI/Services.pm
+++ b/C4/ILSDI/Services.pm
@@ -25,7 +25,7 @@ use C4::Items;
 use C4::Circulation;
 use C4::Accounts;
 use C4::Biblio;
-use C4::Reserves qw(AddReserve CanBookBeReserved CanItemBeReserved IsAvailableForItemLevelRequest);
+use C4::Reserves qw(AddReserve CanBookBeReserved CanItemBeReserved IsAvailableForItemLevelRequest CanReserveBeCanceledFromOpac);
 use C4::Context;
 use C4::AuthoritiesMarc;
 use XML::Simple;
@@ -806,7 +806,9 @@ sub CancelHold {
     my $reserve_id = $cgi->param('item_id');
     my $hold = Koha::Holds->find( $reserve_id );
     return { code => 'RecordNotFound' } unless $hold;
-    return { code => 'RecordNotFound' } unless ($hold->borrowernumber == $borrowernumber);
+
+    # Check if reserve belongs to the borrower and if it is in a state which allows cancellation
+    return { code => 'BorrowerCannotCancelHold' } unless CanReserveBeCanceledFromOpac( $reserve_id, $borrowernumber );
 
     $hold->cancel;
 
-- 
2.13.7