https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38040
--- Comment #52 from Hammat wele <[email protected]> --- Created attachment 204959 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204959&action=edit Bug 38040: Prevent editing other libraries' holds when IndependentBranches is enabled When IndependentBranches is enabled, any staff member from any library can see and edit the holds for patrons from other libraries. Only superlibrarians should be able to edit all holds, including those from other libraries. Staff patrons should only be able to edit or delete holds for their library. Test plan 1. Set IndependentBranches, IndependentBranchesPatronModifications, and IndependentBranchesTransfers to 'Yes' 2. Set canreservefromotherbranches to "Don't allow (with independent branches)" 3. Give limited permissions to a staff patron - circulate - catalogue - delete_borrowers - edit_borrowers - list_borrowers - send_messages_to_borrowers - reserveforothers - updatecharges 4. As the superlibrarian, place several holds on a record with items from various branches 5. Log in as the restricted staff 6. View the holds for the record --> Some will say "A patron from library XX" instead of the name ==> OK 7. Click the trash bin icon to cancel a hold from another library --> Hold is cancelled ==> NOT OK 8. Apply the patch 9. Update Database ./installer/data/mysql/updatedatabase.pl 10. Run yarn api:bundle 11. Set IndependentBranchesHolds preference to YES 12. Repeat step 6 and 7 it's not possible to modify or delete holds from other branches 13. prove t/db_dependent/api/v1/holds.t should be success -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
