Bug 30732

Summary: Librarians with only "place_holds" permission can not suspend and resume holds
Product: Koha Reporter: Kyle M Hall <kyle>
Component: Hold requestsAssignee: Kyle M Hall <kyle>
Status: RESOLVED DUPLICATE QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: emmi.takkinen, fridolin.somers, gmcharlt, sally.healey
Version: 21.05   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 30732: Librarians with only "place_holds" permission can not suspend and resume holds
Bug 30732: Librarians with only "place_holds" permission can not suspend and resume holds
Bug 30732: Librarians with only "place_holds" permission can not suspend and resume holds

Description Kyle M Hall 2022-05-11 13:49:33 UTC
If a librarian only has the place_holds permission, they can see the buttons for placing and suspending holds on moremember.pl and circulation.pl, but cannot use them.
Comment 1 Kyle M Hall 2022-05-11 13:56:52 UTC
Created attachment 134895 [details] [review]
Bug 30732: Librarians with only "place_holds" permission can not suspend and resume holds

If a librarian only has the place_holds permission, they can see the buttons for placing and suspending holds on moremember.pl and circulation.pl, but cannot use them.

Test Plan:
1) Give your librian only the place_holds permission
2) Attempt to suspend and resume holds on moremember.pl and
   circulation.pl
3) Note you cannot
4) Apply this patch
5) Restart all the things!
6) Test again, note you can now suspend and resume holds!
Comment 2 Sally 2022-05-16 10:59:02 UTC
Sorry, Kyle, I can't get this to work - I restarted services before testing.

- I set up a hold and suspended it
- I logged into a limited staff account with only place_hold permission
- I tried to resume the hold and on both pages got, "Your request could not be processed.  Check the logs."
- I logged back in as the superlibrarian account and resumed the hold
- I logged back into the staff account (with only place_hold permission)
- I tried to suspend the hold - this time I got the suspension date box, but any attempt to suspend it (with or without a date) caused the, "Your request could not be processed.  Check the logs." error to show.

I cleared the hold and placed a new one via the limited staff account, but the same error occurred.

I also wondered if it was a cache thing, so as well as clearing the cache, I tried in a different browser - but no joy.
Comment 3 Fridolin Somers 2022-09-12 20:39:47 UTC
I rise to Major because this can be a daily issue for librarians.

Bug 30207 is pushed so we would like this one should go forward.
Comment 4 Kyle M Hall 2022-09-13 10:32:33 UTC
Created attachment 140562 [details] [review]
Bug 30732: Librarians with only "place_holds" permission can not suspend and resume holds

If a librarian only has the place_holds permission, they can see the buttons for placing and suspending holds on moremember.pl and circulation.pl, but cannot use them.

Test Plan:
1) Give your librian only the place_holds permission
2) Attempt to "suspend all" and "resume all" holds on moremember.pl and
   circulation.pl
3) Note you cannot
4) Apply this patch
5) Restart all the things!
6) Test again, note you can now suspend and resume holds!
Comment 5 Kyle M Hall 2022-09-13 10:35:22 UTC
I've amended by test plan! I should have wrote to use the "all" versions of the suspend and resume buttons!
Comment 6 David Nind 2022-09-13 18:31:48 UTC
Created attachment 140601 [details] [review]
Bug 30732: Librarians with only "place_holds" permission can not suspend and resume holds

If a librarian only has the place_holds permission, they can see the buttons for placing and suspending holds on moremember.pl and circulation.pl, but cannot use them.

Test Plan:
1) Give your librian only the place_holds permission
2) Attempt to "suspend all" and "resume all" holds on moremember.pl and
   circulation.pl
3) Note you cannot
4) Apply this patch
5) Restart all the things!
6) Test again, note you can now suspend and resume holds!

Signed-off-by: David Nind <david@davidnind.com>
Comment 7 Katrin Fischer 2022-09-26 20:57:49 UTC
With * this will work with either, place_holds and modify_holds_priority permission, not only with place_holds.

Was this the intended behaviour?

Also: if you have neither, you can still see the buttons. We should add permission checks there as well, so people don't get into the situation in the first place where they get stuck on missing permissions (could be a separate bug).
Comment 8 Kyle M Hall 2022-09-27 10:59:06 UTC
(In reply to Katrin Fischer from comment #7)
> With * this will work with either, place_holds and modify_holds_priority
> permission, not only with place_holds.
> 
> Was this the intended behaviour?
> 
> Also: if you have neither, you can still see the buttons. We should add
> permission checks there as well, so people don't get into the situation in
> the first place where they get stuck on missing permissions (could be a
> separate bug).

Indeed. I think the solution is hide the button unless the patron has place_holds. We can just set the script permission to be for place_holds too, right? If you think that's a good course of action Katrin, I will make those changes.
Comment 9 Emmi Takkinen 2024-05-13 09:37:13 UTC
It seems this has been fixed in bug 31893.
Comment 10 Fridolin Somers 2024-05-29 07:24:35 UTC
Indeed

*** This bug has been marked as a duplicate of bug 31893 ***