Bug 35434 - Non-superlibrarians should not place holds in other libraries when IndependentBranches is enabled
Summary: Non-superlibrarians should not place holds in other libraries when Independen...
Status: Signed Off
Alias: None
Product: Koha
Classification: Unclassified
Component: Hold requests (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Emily-Rose Francoeur
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-11-29 15:48 UTC by Emily-Rose Francoeur
Modified: 2024-05-15 07:21 UTC (History)
8 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 35434: IndependentBranches prevents non-superlibrarians from placing holds in other libraries (2.95 KB, patch)
2023-11-29 16:06 UTC, Emily-Rose Francoeur
Details | Diff | Splinter Review
Bug 35434: IndependentBranches prevents non-superlibrarians from placing holds in other libraries (3.00 KB, patch)
2024-01-26 11:33 UTC, PTFS Europe Sandboxes
Details | Diff | Splinter Review
Bug 35434: IndependentBranches prevents non-superlibrarians from placing holds in other libraries (3.05 KB, patch)
2024-05-13 15:11 UTC, Baptiste
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Emily-Rose Francoeur 2023-11-29 15:48:35 UTC
In the intranet, when the system preference IndependentBranches is enabled, non-superlibrarians can make reservations in other libraries, which they shouldn't be able to do.
Comment 1 Emily-Rose Francoeur 2023-11-29 16:06:38 UTC
Created attachment 159346 [details] [review]
Bug 35434: IndependentBranches prevents non-superlibrarians from placing holds in other libraries

I updated the hold page on the staff interface so that non-superlibrarians can't place holds in other libraries when the system preference 'IndependentBranches' is enabled.

TEST PLAN
1) Appy the patch.
2) In 'Koha administration > System preferences', set 'IndependentBranches' to 'yes'.
3) In 'Koha administration > Circulation and fines rules', add a rule by only clicking the 'Save' button (this will create a circulation rule for all patron categories and all item types, allowing unlimited holds).
4) Create a staff patron (with username and password).
    ---> In 'Patrons > + New patron > Staff', fill the required fields, add a username and password.
    ---> Remember the home library.
    ---> Click the 'Save' button.
5) Add permissions to the created patron.
    ---> In the patron detail page, click on 'More > Set permissions' and check the following boxes:
	- Staff access, allows viewing of catalogue in staff interface
	- Add, modify and view patron information
	- Place and modify holds for patrons
    ---> Click the 'Save' button.
6) Create an other patron of any patron category with the same home library as the staff patron you created.
7) Create a record with one item.
    ---> In 'Cataloging > + New record', fill the required fields.
    ---> Click the 'Save' button.
    ---> You should now be in the item form. Fill the required field (home library and current library should be the same as the patron's home library).
    ---> Click the 'Add item' button.
8) On the record details page, click 'Place hold' and search for the patron you created in step 6.
    ---> In the 'Pickup at' field, you should see all the libraries.
    ---> In the 'Allowed pickup locations' column of the item, you should see the same.
9) Log out from the staff interface and login with the staff patron you created.
10) Click 'Search catalog' from the search bar and search for the record you created.
11) On the record details page, click 'Place hold', then search for the patron in step 6.
    ---> In the 'Pickup at' field, you should only see the home library of the item.
    ---> In the 'Allowed pickup locations' column of the item, you should see the same.
Comment 2 Lucas Gass 2023-11-30 21:29:19 UTC
Emily, can we have a unit test for this?
Comment 3 Katrin Fischer 2023-11-30 22:34:51 UTC
IIRC canreservefromotherbranches was also used in this context, but it seems missing from the test plan.
Comment 4 PTFS Europe Sandboxes 2024-01-26 11:33:12 UTC
Created attachment 161509 [details] [review]
Bug 35434: IndependentBranches prevents non-superlibrarians from placing holds in other libraries

I updated the hold page on the staff interface so that non-superlibrarians can't place holds in other libraries when the system preference 'IndependentBranches' is enabled.

TEST PLAN
1) Appy the patch.
2) In 'Koha administration > System preferences', set 'IndependentBranches' to 'yes'.
3) In 'Koha administration > Circulation and fines rules', add a rule by only clicking the 'Save' button (this will create a circulation rule for all patron categories and all item types, allowing unlimited holds).
4) Create a staff patron (with username and password).
    ---> In 'Patrons > + New patron > Staff', fill the required fields, add a username and password.
    ---> Remember the home library.
    ---> Click the 'Save' button.
5) Add permissions to the created patron.
    ---> In the patron detail page, click on 'More > Set permissions' and check the following boxes:
	- Staff access, allows viewing of catalogue in staff interface
	- Add, modify and view patron information
	- Place and modify holds for patrons
    ---> Click the 'Save' button.
6) Create an other patron of any patron category with the same home library as the staff patron you created.
7) Create a record with one item.
    ---> In 'Cataloging > + New record', fill the required fields.
    ---> Click the 'Save' button.
    ---> You should now be in the item form. Fill the required field (home library and current library should be the same as the patron's home library).
    ---> Click the 'Add item' button.
8) On the record details page, click 'Place hold' and search for the patron you created in step 6.
    ---> In the 'Pickup at' field, you should see all the libraries.
    ---> In the 'Allowed pickup locations' column of the item, you should see the same.
9) Log out from the staff interface and login with the staff patron you created.
10) Click 'Search catalog' from the search bar and search for the record you created.
11) On the record details page, click 'Place hold', then search for the patron in step 6.
    ---> In the 'Pickup at' field, you should only see the home library of the item.
    ---> In the 'Allowed pickup locations' column of the item, you should see the same.

Signed-off-by: Anni Rajala <anni.rajala@turku.fi>
Comment 5 Katrin Fischer 2024-01-28 14:09:02 UTC
(In reply to Katrin Fischer from comment #3)
> IIRC canreservefromotherbranches was also used in this context, but it seems
> missing from the test plan.

Can you please reply/comment?
Comment 6 Blou 2024-01-29 15:09:42 UTC
Emily Rose is back at school.  I'll assign this issue to another dev, they should be able to answer you shortly.
Comment 7 Katrin Fischer 2024-01-29 20:33:07 UTC
Thanks!
Comment 8 Phan Tung Bui 2024-02-27 22:16:00 UTC
Here comes the updated version of plan test :

TEST PLAN
1) Appy the patch.
2) In 'Koha administration > System preferences' : 
    - set 'IndependentBranches' to 'yes'
    - set 'IndependentBranchesPatronModifications' to 'yes'
    - set 'IndependentBranchesTransfers' to 'yes'
    - set 'canreservefromotherbranches' to 'Don't allow'
3) In 'Koha administration > Circulation and fines rules', add a rule by only clicking the 'Save' button (this will create a circulation rule for all patron categories and all item types, allowing unlimited holds).
4) Create a staff patron (with username and password).
    ---> In 'Patrons > + New patron > Staff', fill the required fields, add a username and password.
    ---> Remember the home library.
    ---> Click the 'Save' button.
5) Add permissions to the created patron.
    ---> In the patron detail page, click on 'More > Set permissions' and check the following boxes:
	- Staff access, allows viewing of catalogue in staff interface
	- Add, modify and view patron information
	- Place and modify holds for patrons
    ---> Click the 'Save' button.
6) Create an other patron of any patron category with the same home library as the staff patron you created.
7) Create a record with one item.
    ---> In 'Cataloging > + New record', fill the required fields.
    ---> Click the 'Save' button.
    ---> You should now be in the item form. Fill the required field (home library and current library should be the same as the patron's home library).
    ---> Click the 'Add item' button.
8) On the record details page, click 'Place hold' and search for the patron you created in step 6.
    ---> In the 'Pickup at' field, you should see all the libraries.
    ---> In the 'Allowed pickup locations' column of the item, you should see the same.
9) Log out from the staff interface and login with the staff patron you created.
10) Click 'Search catalog' from the search bar and search for the record you created.
11) On the record details page, click 'Place hold', then search for the patron in step 6.
    ---> In the 'Pickup at' field, you should only see the home library of the item.
    ---> In the 'Allowed pickup locations' column of the item, you should see the same.
Comment 9 Baptiste 2024-05-13 15:11:45 UTC
Created attachment 166648 [details] [review]
Bug 35434: IndependentBranches prevents non-superlibrarians from placing holds in other libraries

I updated the hold page on the staff interface so that non-superlibrarians can't place holds in other libraries when the system preference 'IndependentBranches' is enabled.

TEST PLAN
1) Appy the patch.
2) In 'Koha administration > System preferences', set 'IndependentBranches' to 'yes'.
3) In 'Koha administration > Circulation and fines rules', add a rule by only clicking the 'Save' button (this will create a circulation rule for all patron categories and all item types, allowing unlimited holds).
4) Create a staff patron (with username and password).
    ---> In 'Patrons > + New patron > Staff', fill the required fields, add a username and password.
    ---> Remember the home library.
    ---> Click the 'Save' button.
5) Add permissions to the created patron.
    ---> In the patron detail page, click on 'More > Set permissions' and check the following boxes:
	- Staff access, allows viewing of catalogue in staff interface
	- Add, modify and view patron information
	- Place and modify holds for patrons
    ---> Click the 'Save' button.
6) Create an other patron of any patron category with the same home library as the staff patron you created.
7) Create a record with one item.
    ---> In 'Cataloging > + New record', fill the required fields.
    ---> Click the 'Save' button.
    ---> You should now be in the item form. Fill the required field (home library and current library should be the same as the patron's home library).
    ---> Click the 'Add item' button.
8) On the record details page, click 'Place hold' and search for the patron you created in step 6.
    ---> In the 'Pickup at' field, you should see all the libraries.
    ---> In the 'Allowed pickup locations' column of the item, you should see the same.
9) Log out from the staff interface and login with the staff patron you created.
10) Click 'Search catalog' from the search bar and search for the record you created.
11) On the record details page, click 'Place hold', then search for the patron in step 6.
    ---> In the 'Pickup at' field, you should only see the home library of the item.
    ---> In the 'Allowed pickup locations' column of the item, you should see the same.

Signed-off-by: Anni Rajala <anni.rajala@turku.fi>
Signed-off-by: baptiste <baptiste.bayche@inlibro.com>