From cd3ef03e76e1441675c90135c42d033bf99f73cd Mon Sep 17 00:00:00 2001
From: Katrin Fischer <katrin.fischer.83@web.de>
Date: Sat, 2 Nov 2019 06:54:31 +0000
Subject: [PATCH] Bug 21939: Fix permissions for holds history tab
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

The tab will show when the staff user has edit_borrowers
permission, but the page itself will not be accessible.
This patch fixes the page permissions to allow access
with the edit_borrowers permission as suggested by the
comments on the original bug report.

To test:
- Create a staff user with only "edit_borrowers" permission
  from the borrowers module
- Try to access the holds history tab from any patron account
- Verify you are blocked
- Apply patch
- Try again and verify the page is accessible now
- Repeat with superlibrarian and full borrowers permission.

Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
---
 members/holdshistory.pl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/members/holdshistory.pl b/members/holdshistory.pl
index c17535ba58..d0d96e0c27 100755
--- a/members/holdshistory.pl
+++ b/members/holdshistory.pl
@@ -34,7 +34,7 @@ my ($template, $loggedinuser, $cookie)= get_template_and_user({template_name =>
                 query => $input,
                 type => "intranet",
                 authnotrequired => 0,
-                flagsrequired => {borrowers => 1},
+                flagsrequired => {borrowers => 'edit_borrowers'},
                 debug => 1,
                 });
 
-- 
2.39.5