Bug 28975 - Holds queue lists can show holds from all libraries even with IndependentBranches
Summary: Holds queue lists can show holds from all libraries even with IndependentBran...
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Circulation (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Shi Yao Wang
QA Contact: Kyle M Hall
URL:
Keywords:
: 29944 (view as bug list)
Depends on:
Blocks:
 
Reported: 2021-09-08 19:48 UTC by Caroline Cyr La Rose
Modified: 2023-12-28 20:44 UTC (History)
14 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.05.00, 22.11.01, 22.05.09, 21.11.16


Attachments
Bug 28975: Holds queue lists can show holds from all libraries even with IndependentBranches (2.62 KB, patch)
2022-01-25 17:25 UTC, The Minh Luong
Details | Diff | Splinter Review
Bug 28975: Holds queue lists can show holds from all libraries even with IndependentBranches (2.50 KB, patch)
2022-07-04 18:32 UTC, Shi Yao Wang
Details | Diff | Splinter Review
Bug 28975: Holds queue lists can show holds from all libraries even with IndependentBranches (2.55 KB, patch)
2022-07-05 13:35 UTC, Shi Yao Wang
Details | Diff | Splinter Review
Bug 28975: Holds queue lists can show holds from all libraries even with IndependentBranches (2.60 KB, patch)
2022-12-02 14:18 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 28975: (QA follow-up) Fix indentation, simplify if statement (1.49 KB, patch)
2022-12-02 14:19 UTC, Kyle M Hall
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Caroline Cyr La Rose 2021-09-08 19:48:21 UTC
When using IndependentBranches, usually all branches are removed from the drop-down menus. But in the Holds Queue page, there is the possibility to choose "All branches". From there, you can see holds for patrons from other branches and even click on the names of the patrons to access their file and see their information (!!).

To recreate :
1) Activate IndependentBranches, IndependentBranchesPatronModifications and IndependentBranchesTransfers
2) Create a staff user with limited permissions (NOT a superlibrarian), including holds permissions. Here are mine as an example
  - circulate (all)
  - catalogue
  - borrowers
    - delete_borrowers
    - edit_borrowers
  - reserveforothers (all)
  - reports (all)
3) Create (or make sure you already have) a patron in another branch (we'll call them patron X)
4) Place a hold for patron X on an available item from their own library
5) Run misc/cronjobs/holds/build_holds_queue.pl
6) Go to Circulation > Holds queue and make sure you can see the hold
7) Log in as your limited staff patron
8) Go to Circulation > Holds queue
9) In the drop-down menu, choose "All" and click Submit
-- Patron X and their hold appear in the list
10) Click on patron X's name
-- You can access patron X's file and see their information

Superlibrarians should be able to select any library, but non-superlibrarians should only be able to select their own library from the drop-down menu.
Comment 1 Blou 2022-01-25 16:33:48 UTC
*** Bug 29944 has been marked as a duplicate of this bug. ***
Comment 2 The Minh Luong 2022-01-25 17:25:17 UTC Comment hidden (obsolete)
Comment 3 catherine.dupuy-lenen 2022-06-30 14:48:28 UTC
I couldn't place a hold : I've got this error :
"Can't call method "notforloan" on an undefined value at /kohadevbox/koha/C4/Reserves.pm line 1445".
And I can't run the cronjob build_holds_queue
Comment 4 Victor Grousset/tuxayo 2022-06-30 14:56:36 UTC
> I couldn't place a hold : I've got this error :
"Can't call method "notforloan" on an undefined value at /kohadevbox/koha/C4/Reserves.pm line 1445".

Note: this is without the patch


> And I can't run the cronjob build_holds_queue

Note: this is from a sandbox (we are doing a test session with librarians ^^)
Comment 5 Katrin Fischer 2022-07-02 13:06:00 UTC
Maybe check if the items had holdingbranch, homebranch and itemtype correctly set, I believe the error could be that.
Comment 6 Shi Yao Wang 2022-07-04 18:32:17 UTC Comment hidden (obsolete)
Comment 7 Shi Yao Wang 2022-07-05 13:35:55 UTC
Created attachment 137170 [details] [review]
Bug 28975: Holds queue lists can show holds from all libraries even with IndependentBranches

When using IndependentBranches, usually all branches are removed from the drop-down menus. But in the Holds Queue page, there is the possibility to choose "All branches". From there, you can see holds from all libraries.

To recreate :
1) Activate IndependentBranches, IndependentBranchesPatronModifications and IndependentBranchesTransfers
2) Create a staff user with limited permissions (NOT a superlibrarian), including holds permissions. Here are mine as an example
  - circulate (all)
  - catalogue
  - borrowers
    - delete_borrowers
    - edit_borrowers
  - reserveforothers (all)
  - reports (all)
3) Create (or make sure you already have) a patron in another branch (we'll call them patron X)
4) Place a hold for patron X on an available item from their own library
5) Run misc/cronjobs/holds/build_holds_queue.pl
6) Go to Circulation > Holds queue and make sure you can see the hold
7) Log in as your limited staff patron
8) Go to Circulation > Holds queue
9) In the drop-down menu, choose "All" and click Submit
-- Notice you see the hold of the patron from another branch under Patron
column: "A patron from library <library name>"
11) Apply the patch.
12) Notice that the "All" option is no longer available for the limited patron. Limited patrons can't see holds from other libraries anymore.
Comment 8 Laura Escamilla 2022-11-09 20:30:25 UTC
Signed-Off: Laura Escamilla (Laura.escamilla@bywatersolutions.com)
Comment 9 Kyle M Hall 2022-12-02 14:18:48 UTC
Created attachment 144402 [details] [review]
Bug 28975: Holds queue lists can show holds from all libraries even with IndependentBranches

When using IndependentBranches, usually all branches are removed from the drop-down menus. But in the Holds Queue page, there is the possibility to choose "All branches". From there, you can see holds from all libraries.

To recreate :
1) Activate IndependentBranches, IndependentBranchesPatronModifications and IndependentBranchesTransfers
2) Create a staff user with limited permissions (NOT a superlibrarian), including holds permissions. Here are mine as an example
  - circulate (all)
  - catalogue
  - borrowers
    - delete_borrowers
    - edit_borrowers
  - reserveforothers (all)
  - reports (all)
3) Create (or make sure you already have) a patron in another branch (we'll call them patron X)
4) Place a hold for patron X on an available item from their own library
5) Run misc/cronjobs/holds/build_holds_queue.pl
6) Go to Circulation > Holds queue and make sure you can see the hold
7) Log in as your limited staff patron
8) Go to Circulation > Holds queue
9) In the drop-down menu, choose "All" and click Submit
-- Notice you see the hold of the patron from another branch under Patron
column: "A patron from library <library name>"
11) Apply the patch.
12) Notice that the "All" option is no longer available for the limited patron. Limited patrons can't see holds from other libraries anymore.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 10 Kyle M Hall 2022-12-02 14:19:04 UTC
Created attachment 144403 [details] [review]
Bug 28975: (QA follow-up) Fix indentation, simplify if statement

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 11 Tomás Cohen Arazi 2022-12-07 17:30:32 UTC
Pushed to master for 23.05.

Nice work everyone, thanks!
Comment 12 Matt Blenkinsop 2022-12-09 10:58:26 UTC
Nice work everyone!

Pushed to stable for 22.11.x
Comment 13 Lucas Gass 2023-01-18 21:47:43 UTC
Backported to 22.05.x for upcoming 22.05.09
Comment 14 Arthur Suzuki 2023-01-26 10:05:58 UTC
pushed to 21.11.x for 21.11.16
Comment 15 wainuiwitikapark 2023-03-15 01:29:50 UTC
Not backported to 21.05.x