If you DON'T have AllowAllMessageDeletion enabled, message deletion is supposed to be limited by library: Staff from the same library can delete each other's messages, but not messages left by other libraries. At some point the logic around the display of the "Delete" link got changed, I think by Bug 21757. Now the check compares the branchcode of the staff member who left the message with the branchcode of the patron: patron_message.branchcode == patron.branchcode I think this is meant to compare patron_message.branchcode to the logged-in library.
Created attachment 129514 [details] [review] Bug 29889: Incorrect library check in patron message deletion logic This patch corrects the logic controlling whether a patron message on the circulation or patron details page has a "Delete" link. An error in the logic prevented messages from being removed by staff who should have been authorized to do so. To reproduce the bug, check that your AllowAllMessageDeletion preference is disabled. - In the staff client, check out to a patron whose home library doesn't match the library you're logged in at. - Add a message to the patron's account. - You should see no "Delete" link next to the newly-added message. - If you edit the patron so that their home library matches the library you're logged in at the delete link will appear. To test, apply the patch and follow the steps above. The delete link should aways appear if the message was left by someone logged in at the same library.
Created attachment 129592 [details] [review] Bug 29889: Incorrect library check in patron message deletion logic This patch corrects the logic controlling whether a patron message on the circulation or patron details page has a "Delete" link. An error in the logic prevented messages from being removed by staff who should have been authorized to do so. To reproduce the bug, check that your AllowAllMessageDeletion preference is disabled. - In the staff client, check out to a patron whose home library doesn't match the library you're logged in at. - Add a message to the patron's account. - You should see no "Delete" link next to the newly-added message. - If you edit the patron so that their home library matches the library you're logged in at the delete link will appear. To test, apply the patch and follow the steps above. The delete link should aways appear if the message was left by someone logged in at the same library. Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Trivial, skipping QA.
I'm about to push master I was puzzled by test plan until I understood it is without patch, then with patch :) BTW : We may allow superlibrarian to delete any message even when system preference is disabled.
Pushed to master for 22.05, thanks to everybody involved [U+1F984]
Pushed to 21.11.x for 21.11.03
Missing dependency, not backported to 21.05