Bug 31391: (QA follow-up) Hide "Convert selected to recall" for users with no recalls permission

This introduces a permission check on "recalls" for the link on the holds summary page.

1) Go to http://localhost:8081/cgi-bin/koha/admin/smart-rules.pl, and under the default rule, set:
- 'Recalls allowed (total)': 5
- 'Recalls per record': 3
- 'On shelf recalls allowed': if any unavailable
- 'Recall due date interval': 5
- 'Recall overdue fine amount': 5
- 'Recall pickup period': 2
2) Go to 'Administration' > 'Global system preferences' (http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=UseRecalls), set 'UseRecalls' to 'can be placed through the staff interface only'.
3) Go to Henry's patron account, borrowernumber 19, set him a password (http://localhost:8081/cgi-bin/koha/members/member-password.pl?member=19), then edit his permissions (http://localhost:8081/cgi-bin/koha/members/member-flags.pl?member=19) and give him only 'catalogue' and 'reserveforothers' (place holds), do not give him 'recalls'.
4) As a superlibrarian, check out item 39999000003154 (biblionumber 76) to borrowernumber 23, then place a hold on that same record for borrowernumber 49
5) Log out and log back in as Henry.
6) Go to http://localhost:8081/cgi-bin/koha/reserve/request.pl?biblionumber=76, tick the checkbox next to the hold, click 'Convert selected to recall', confirm in the modal.
7) The hold gets cancelled and a recall gets created, even though Henry has no recalls permission at all, proving the action isn't actually gated by it.
8) Apply patch, re-run test plan to 6) - The link to convert should no longer display.
9) Toggle the recalls permission for Henry, link to convert should now reappear.

Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
This commit is contained in:
Katrin Fischer 2026-09-14 12:39:33 +00:00 committed by Pedro Amorim
parent 3df7914925
commit 324b4d2fbe
No known key found for this signature in database
GPG Key ID: 06B75BA7F3894D55
2 changed files with 6 additions and 3 deletions

View File

@ -1605,6 +1605,7 @@
return e;
});
var CAN_user_reserveforothers_modify_holds_priority = [%CAN_user_reserveforothers_modify_holds_priority ? 1 : 0 | html %];
var CAN_user_recalls = [%CAN_user_recalls ? 1 : 0 | html %];
var borrowernumber = "[% patron.borrowernumber | $raw %]";
var patron_homebranch = "[% To.json( Branches.GetName( patron.branchcode ) ) | $raw %]";
var override_items = {[% FOREACH biblio_info IN biblioloop %][% FOREACH itemloo IN biblio_info.itemloop %][% IF ( itemloo.override ) %]

View File

@ -1983,9 +1983,11 @@ async function load_patron_holds_table(biblio_id, split_data) {
$("#convert_hold_alert").html(
MSG_CONVERT_ALERT.format(selectedCount, selectedCount)
);
$(".convert_selected_holds").html(
MSG_RECALL_SELECTED.format(selectedCount)
);
if (CAN_user_recalls) {
$(".convert_selected_holds").html(
MSG_RECALL_SELECTED.format(selectedCount)
);
}
if (selectedCount > 0) {
$("#cancel_hold_alert").show();
$("#convert_hold_alert").show();