Bug 30048

Summary: Koha::ArticleRequests->search_limited may be malformed.
Product: Koha Reporter: Martin Renvoize (ashimema) <martin.renvoize>
Component: Architecture, internals, and plumbingAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: andrew, jonathan.druart, kyle, tomascohen
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29886
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29888
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30019
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Martin Renvoize (ashimema) 2022-02-08 15:31:45 UTC
Whilst digging through Koha::Suggestions with bug 29886 it highlighted to me that our 'search_limited' method differs somewhat between different Koha classes.

My initial understanding, from Koha::Patrons->search_limited, was that the idea of search_limited was to protect patron data across branches.  In actual fact, it's more about restricting the object class in questions data from being leaked across branches. 

As such, I think the construction used in ArticleRequests is incorrect. Instead of limiting based on the requesting patrons attached to the requests the currently logged in patron can see.. we should be limiting simply by which libraries the current patron is allowed to see... and the linked patron details should be getting obfuscated in their own right.