https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31391
--- Comment #285 from Pedro Amorim (ammopt) <[email protected]> --- Created attachment 205780 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=205780&action=edit Bug 31391: (RM follow-up) Enforce recalls permission when converting holds to recalls The previous follow-up only blanked the button's label via JS for users without the recalls permission; the button still rendered, was still clickable, and modrequest.pl's cud-convertall had no permission check at all, so the conversion still succeeded. Adds CAN_user_recalls to the button's template condition (matching the existing "Move selected holds" button) so it doesn't render at all without the permission, drops the now-redundant JS check in holds.js, and adds a manage_recalls check in modrequest.pl itself. checkauth()'s userid is the login username, not a borrowernumber, so this uses C4::Auth::haspermission() directly rather than Koha::Patrons->find(). Test plan: 1) Set a default recalls rule in admin/smart-rules.pl. 2) Set UseRecalls to 'staff' or 'opac_and_staff'. 3) Give a test patron 'catalogue' + 'reserveforothers' but not 'recalls'. 4) Check out an item, place a hold on it for another patron. 5) As the test patron, go to that record's Holds tab, confirm 'Convert selected to recall' doesn't appear. 6) Since the button is gone, confirm the server side is enforced too: post op=cud-convertall directly to modrequest.pl and confirm it no longer converts the hold. 7) Grant 'recalls' and confirm the button reappears and works. Co-Authored-By: Claude Sonnet 5 <[email protected]> -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
