From 324b4d2fbedd5f94ef9675adb6abafd281880de8 Mon Sep 17 00:00:00 2001 From: Katrin Fischer Date: Mon, 14 Sep 2026 12:39:33 +0000 Subject: [PATCH] Bug 31391: (QA follow-up) Hide "Convert selected to recall" for users with no recalls permission This introduces a permission check on "recalls" for the link on the holds summary page. 1) Go to http://localhost:8081/cgi-bin/koha/admin/smart-rules.pl, and under the default rule, set: - 'Recalls allowed (total)': 5 - 'Recalls per record': 3 - 'On shelf recalls allowed': if any unavailable - 'Recall due date interval': 5 - 'Recall overdue fine amount': 5 - 'Recall pickup period': 2 2) Go to 'Administration' > 'Global system preferences' (http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=UseRecalls), set 'UseRecalls' to 'can be placed through the staff interface only'. 3) Go to Henry's patron account, borrowernumber 19, set him a password (http://localhost:8081/cgi-bin/koha/members/member-password.pl?member=19), then edit his permissions (http://localhost:8081/cgi-bin/koha/members/member-flags.pl?member=19) and give him only 'catalogue' and 'reserveforothers' (place holds), do not give him 'recalls'. 4) As a superlibrarian, check out item 39999000003154 (biblionumber 76) to borrowernumber 23, then place a hold on that same record for borrowernumber 49 5) Log out and log back in as Henry. 6) Go to http://localhost:8081/cgi-bin/koha/reserve/request.pl?biblionumber=76, tick the checkbox next to the hold, click 'Convert selected to recall', confirm in the modal. 7) The hold gets cancelled and a recall gets created, even though Henry has no recalls permission at all, proving the action isn't actually gated by it. 8) Apply patch, re-run test plan to 6) - The link to convert should no longer display. 9) Toggle the recalls permission for Henry, link to convert should now reappear. Signed-off-by: Pedro Amorim --- .../intranet-tmpl/prog/en/modules/reserve/request.tt | 1 + koha-tmpl/intranet-tmpl/prog/js/holds.js | 8 +++++--- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt index 4566e72a95..aa0aaf2359 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt @@ -1605,6 +1605,7 @@ return e; }); var CAN_user_reserveforothers_modify_holds_priority = [%CAN_user_reserveforothers_modify_holds_priority ? 1 : 0 | html %]; + var CAN_user_recalls = [%CAN_user_recalls ? 1 : 0 | html %]; var borrowernumber = "[% patron.borrowernumber | $raw %]"; var patron_homebranch = "[% To.json( Branches.GetName( patron.branchcode ) ) | $raw %]"; var override_items = {[% FOREACH biblio_info IN biblioloop %][% FOREACH itemloo IN biblio_info.itemloop %][% IF ( itemloo.override ) %] diff --git a/koha-tmpl/intranet-tmpl/prog/js/holds.js b/koha-tmpl/intranet-tmpl/prog/js/holds.js index ed6e80cb19..a6d9ee2fc1 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/holds.js +++ b/koha-tmpl/intranet-tmpl/prog/js/holds.js @@ -1983,9 +1983,11 @@ async function load_patron_holds_table(biblio_id, split_data) { $("#convert_hold_alert").html( MSG_CONVERT_ALERT.format(selectedCount, selectedCount) ); - $(".convert_selected_holds").html( - MSG_RECALL_SELECTED.format(selectedCount) - ); + if (CAN_user_recalls) { + $(".convert_selected_holds").html( + MSG_RECALL_SELECTED.format(selectedCount) + ); + } if (selectedCount > 0) { $("#cancel_hold_alert").show(); $("#convert_hold_alert").show();