| Summary: | OPAC: Placing holds still possible by URL even if turned off by system preference | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Marc Véron <veron> |
| Component: | Hold requests | Assignee: | Marc Véron <veron> |
| Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
| Severity: | major | ||
| Priority: | P5 - low | CC: | chris, gmcharlt, jonathan.druart, tomascohen |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Attachments: |
OPAC: Putting holds still possible by URL even if turned off by system preference
Bug 13917: OPAC: Putting holds still possible by URL even if turned off by system preference [PASSED QA] Bug 13917: OPAC: Putting holds still possible by URL even if turned off by system preference |
||
|
Description
Marc Véron
2015-03-26 13:46:27 UTC
Created attachment 37274 [details] [review] OPAC: Putting holds still possible by URL even if turned off by system preference To test: 1) Prepare an URL that put's a hold in OPAC (see comment #1), e.g. [YOUR SERVER]/cgi-bin/koha/opac-reserve.pl?biblionumbers=1 2) Set system preference 'RequestOnOpac' to 'Don't allow patrons to place holds on items from the OPAC.' 3) Go diectly to this URL. Result: The page displays to confirm hold (wrong) 4) Apply patch 5) Repeat step 3 Result: Redirect to 404 page (OK) 6) Set system preference to "Allow" 7) Repeat step 3 Result: The page displays to confirm hold (OK), like it would be from link in OPAC. Re-tested, still applies. Created attachment 37717 [details] [review] Bug 13917: OPAC: Putting holds still possible by URL even if turned off by system preference To test: 1) Prepare an URL that put's a hold in OPAC (see comment #1), e.g. [YOUR SERVER]/cgi-bin/koha/opac-reserve.pl?biblionumbers=1 2) Set system preference 'RequestOnOpac' to 'Don't allow patrons to place holds on items from the OPAC.' 3) Go diectly to this URL. Result: The page displays to confirm hold (wrong) 4) Apply patch 5) Repeat step 3 Result: Redirect to 404 page (OK) 6) Set system preference to "Allow" 7) Repeat step 3 Result: The page displays to confirm hold (OK), like it would be from link in OPAC. Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> Hum, I would raise the severity to major for this one. Created attachment 37917 [details] [review] [PASSED QA] Bug 13917: OPAC: Putting holds still possible by URL even if turned off by system preference To test: 1) Prepare an URL that put's a hold in OPAC (see comment #1), e.g. [YOUR SERVER]/cgi-bin/koha/opac-reserve.pl?biblionumbers=1 2) Set system preference 'RequestOnOpac' to 'Don't allow patrons to place holds on items from the OPAC.' 3) Go diectly to this URL. Result: The page displays to confirm hold (wrong) 4) Apply patch 5) Repeat step 3 Result: Redirect to 404 page (OK) 6) Set system preference to "Allow" 7) Repeat step 3 Result: The page displays to confirm hold (OK), like it would be from link in OPAC. Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> I think if we look really close... we'd find more features that need this kind of fix - thx for the patch! Patch pushed to master. Nice catch Marc! Pushed to 3.18.x will be in 3.18.6 |