Bug 22265 - Processing article requests requires borrowers permission
Summary: Processing article requests requires borrowers permission
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Circulation (show other bugs)
Version: master
Hardware: All All
: P5 - low minor (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-02-03 11:16 UTC by Katrin Fischer
Modified: 2019-02-03 11:16 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2019-02-03 11:16:41 UTC
I just noticed that you will only be able to see article requests if the staff patron has "borrowers" permission. You can still access the article requests page without the permission, but it will always show "no pending article requests".

This dependency doesn't seem logical, especially since you can still access the page and it just seems like there are no requests. The problem seems to come from this part of the code:

Koha::ArticleRequests:

sub search_limited {
    my ( $self, $params, $attributes ) = @_;

    my $userenv = C4::Context->userenv;
    my @restricted_branchcodes;
    if ( $userenv and $userenv->{number} ) {
        my $logged_in_user = Koha::Patrons->find( $userenv->{number} );
        @restricted_branchcodes = $logged_in_user->libraries_where_can_see_patrons;
    }
    # TODO This 'borrowernumber' relation name is confusing and needs to be renamed
    $params->{'borrowernumber.branchcode'} = { -in => \@restricted_branchcodes } if @restricted_branchcodes;
    $attributes->{join} = 'borrowernumber';
    return $self->search( $params, $attributes );
}


Not sure yet what the best way would be:

Do we want to allow article request processing without borrowers?

   If no, we could hide article requests from view if the staff user doesn't
   have the required permission.

   If yes, what would be the consequence? (stuck on that one)