Bug 38040

Summary:	IndependentBranches doesn't prevent editing other libraries' holds
Product:	Koha	Reporter:	Caroline Cyr La Rose <caroline.cyr-la-rose>
Component:	Hold requests	Assignee:	Bugs List <koha-bugs>
Status:	Needs Signoff ---	QA Contact:	Testopia <testopia>
Severity:	normal
Priority:	P5 - low	CC:	gmcharlt, philippe.blouin, sukhmandeep.benipal
Version:	Main
Hardware:	All
OS:	All
Change sponsored?:	---	Patch complexity:	---
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:
Circulation function:
Attachments:	Bug 38040: Disabled tables element for staff

Description Caroline Cyr La Rose 2024-09-30 16:48:08 UTC

When IndependentBranches is set, any staff member from any library can see and edit the holds from patrons from other libraries.


1. Set IndependentBranches, IndependentBranchesPatronModifications, and IndependentBranchesTransfers to 'Yes'

2. Set canreservefromotherbranches to "Don't allow (with independent branches)"

3. Give limited permissions to a staff patron
   - circulate
   - catalogue
   - delete_borrowers
   - edit_borrowers
   - list_borrowers
   - send_messages_to_borrowers
   - reserveforothers
   - updatecharges

4. As the superlibrarian, place several holds on a record with items from various branches

5. Log in as the restricted staff

6. View the holds for the record
   --> Some will say "A patron from library XX" instead of the name -- OK

7. Click the trash bin icon to cancel a hold from another library
   --> Hold is cancelled -- NOT OK

I feel like it should only be superlibrarians who can edit all holds, even those from other libraries.

Comment 1 Sukhmandeep 2024-10-25 16:38:30 UTC

Created attachment 173400 [details] [review]
Bug 38040: Disabled tables element for staff

The test plan is the same has mentioned before:
1. Set IndependentBranches, IndependentBranchesPatronModifications, and IndependentBranchesTransfers to 'Yes'

2. Set canreservefromotherbranches to "Don't allow (with independent branches)"

3. Give limited permissions to a staff patron
   - circulate
   - catalogue
   - delete_borrowers
   - edit_borrowers
   - list_borrowers
   - send_messages_to_borrowers
   - reserveforothers
   - updatecharges

4. As the superlibrarian, place several holds on a record with items from various branches

5. Log in as the restricted staff

6. View the holds for the record
   --> Some will say "A patron from library XX" instead of the name -- OK

7. Click the trash bin icon to cancel a hold from another library
   --> Hold is cancelled -- NOT OK
8. Apply the patch and validate that step 7 is not possible now.