Bug 20793 - Don't show holds link in result list when staff user doesn't have place_holds permission
Summary: Don't show holds link in result list when staff user doesn't have place_holds...
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Circulation (show other bugs)
Version: master
Hardware: All All
: P5 - low minor (vote)
Assignee: Katrin Fischer
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-05-20 00:41 UTC by Katrin Fischer
Modified: 2019-10-14 19:57 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 20793: Don't show a holds link in staff for users without permission (4.81 KB, patch)
2018-05-20 00:53 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 20793: Don't show a holds link in staff for users without permission (4.86 KB, patch)
2018-05-22 16:30 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 20793: (follow-up) Add style to the non-link hold count on detail page (1.80 KB, patch)
2018-05-22 16:30 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 20793: (follow-up) Add style to the non-link hold count on detail page (1.87 KB, patch)
2018-05-28 22:05 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 20793: Don't show a holds link in staff for users without permission (4.94 KB, patch)
2018-05-30 20:24 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 20793: (follow-up) Add style to the non-link hold count on detail page (1.94 KB, patch)
2018-05-30 20:24 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2018-05-20 00:41:21 UTC
When a user doens't have 'place_holds' permission, the link on the result list should not show as a link as it only leads to a permission error.
Comment 1 Katrin Fischer 2018-05-20 00:53:46 UTC Comment hidden (obsolete)
Comment 2 Owen Leonard 2018-05-22 16:30:50 UTC Comment hidden (obsolete)
Comment 3 Owen Leonard 2018-05-22 16:30:53 UTC Comment hidden (obsolete)
Comment 4 Katrin Fischer 2018-05-28 22:05:30 UTC Comment hidden (obsolete)
Comment 5 Katrin Fischer 2018-05-28 22:05:53 UTC
Thx a lot for the follow-up, Owen. Looks much better!
Comment 6 Jonathan Druart 2018-05-30 20:24:16 UTC
Created attachment 75690 [details] [review]
Bug 20793: Don't show a holds link in staff for users without permission

On the results list in staff the 'Holds (x)' link always shows
independent of the permissions of the staff user.

This patch tightens the permission checks on the result page
to explicitly check for the place_holds permission.

To test:
- Create a staff user with place_holds permission
- Check the result list, you should see 2 links to the
  holds page:
  - 'Place holds' on top of the results list
  - 'Holds (x)' at the bottom of each entry in the results
     list
  - Verify both links work
- Create a staff user without place_holds_permission
  - Without the patch you'll see the second link,
    but it will lead to a permission error
  - With the patch you'll still see the 'Holds (x)', but
    it will no longer be a link.
- Go to the detail page of a record with an existing hold.
  - Repeat test with both staff users.
  - One time the Hold information in the bibliographic information
    should show as a link, the other time as a simple text.

Displaying the information about existing holds still make sense
as this is the current beheviour.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 7 Jonathan Druart 2018-05-30 20:24:19 UTC
Created attachment 75691 [details] [review]
Bug 20793: (follow-up) Add style to the non-link hold count on detail page

This small follow-up changes the style on the bibliographic detail page
of the hold count so that it looks similar whether it's a link to holds
or not.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 8 Nick Clemens 2018-07-02 13:16:32 UTC
Awesome work all!

Pushed to master for 18.11
Comment 9 Martin Renvoize 2018-07-02 17:14:46 UTC
Pushed to 18.05.x for 18.05.02
Comment 10 Fridolin Somers 2018-07-04 14:40:20 UTC
Pushed to 17.11.x for 17.11.08