https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43949
Bug ID: 43949
Summary: Holds table: show the patron's library for patrons the
user cannot see
Initiative type: ---
Sponsorship ---
status:
Product: Koha
Version: Main
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P5 - low
Component: Hold requests
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected], [email protected],
[email protected]
Target Milestone: ---
On a record's holds list (reserve/request.pl, holds.js load_patron_holds_table)
the patron column is built from the /api/v1/holds response with embed=patron.
When the logged in staff user is not allowed to see the patron
(IndependentBranches, or library groups with "Hide patron info" and no
view_borrower_infos_from_any_libraries permission), Koha::Object->to_api
redacts the embedded patron: every field is set to undef except those in
Koha::Patron->unredact_list, which is only branchcode (exposed as library_id).
The redacted patron is therefore a non-null object, so the fallback added in
bug 42915 (row.patron == null, showing "A patron from library X") never runs.
Instead $patron_to_html (patron-format.js) gets a patron with no name, and
because patron.library is not embedded it can only ever print the generic "A
patron from another library", even though patron-format.js already supports "A
patron from <library name>" when patron.library is present.
Proposed fix:
- Allow patron.library in the x-koha-embed enum of GET /holds
(api/v1/swagger/paths/holds.yaml)
- Request the patron.library embed from the holds table in holds.js
- $patron_to_html then shows "A patron from <patron's home library>" for
patrons the user cannot see
The library name is not sensitive: library_id is already exposed for redacted
patrons, and the list of libraries is public. The existing row.patron == null
fallback in holds.js shows the pickup library, which is not the patron's
library, so it is left as a last resort only.
Test plan:
1. Set up two libraries, A and B, and a staff user at library A without the
view_borrower_infos_from_any_libraries permission (or enable
IndependentBranches)
2. Place a hold for a patron whose home library is B on a record
3. As the staff user at A, open the record's holds page (reserve/request.pl)
4. Before the patch: the patron cell reads "A patron from another library"
5. After the patch: it reads "A patron from <name of library B>"
6. As a superlibrarian, confirm patrons are shown by name as before
7. prove t/db_dependent/api/v1/holds.t
--
You are receiving this mail because:
You are the assignee for the bug.
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list -- [email protected]
To unsubscribe send an email to [email protected]
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
