Bug 41130

Summary: Hold policy overrides do not require a user permission
Product: Koha Reporter: Andrew Fuerste-Henry <andrew>
Component: Hold requestsAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: gmcharlt, hebah, lisette, tomascohen
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27464
GIT URL: Initiative type: ---
Sponsorship status: --- Crowdfunding goal: 0
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Andrew Fuerste-Henry 2025-10-29 12:55:24 UTC
One of the issues with the AllowHoldPolicyOverride system preference is that it does not have a corresponding user permission, so once the system preference is enabled any user who can place a hold can override hold policies.

By comparison, the various overrides related to checkouts require a system preference to be enabled and for the user to have the force_checkout permission.