[OPEN-ILS-GENERAL] View Holds Screen

Wed Apr 9 16:18:36 EDT 2014

We recently found and patched up this hole (and on some other screens,  
too, such as Item Status > Last Few circulations). We made EG check  
the opted-in table to block displaying patrons who have not opted-in.  
Staff will see a prompt for it.

This is done by Liam. He has marked it for pushing to upstream. I am  
not sure he's done it or not.

Tina

Quoting Mike Rylander <mrylander at gmail.com>:

> Ben,
>
> You're recollecting correctly -- Sitka was the driver for the feature.
>  I am not surprised that there are ways around the "wall", which was
> primarily intended for stopping direct access without a link, but
> allowing it when there is one -- such as when a "foreign" patron
> checks out a "local" item.  I'm fairly certain that development would
> be required to lock down this particular visibility leak, and that
> there's no setting to expressly prevent it.
>
>
> On Wed, Apr 9, 2014 at 3:21 PM, Ben Shum <bshum at biblio.org> wrote:
>> Hi Fiona,
>>
>> I'm not too familiar with this area of Evergreen (in our consortium,
>> people share and want to see everything), but I remember in the old
>> days there's opt-in settings for patrons to say whether or not they
>> give permission to be viewed at different libraries within a system.
>> My recollection was that Sitka, Conifer, or Michigan libraries made
>> use of these features.
>>
>> I'll see what I can dig up, or maybe this reply with spark an idea
>> with someone who knows more about the current state of patron opt-in
>> functionality.
>>
>> -- Ben
>>
>> On Wed, Apr 9, 2014 at 10:25 AM, Borthwick, Fiona
>> <fiona.borthwick at ptfs-europe.com> wrote:
>>> Hi,
>>>
>>> I really hope someone in the community can help with a problem that one of
>>> our customers has.  There are 2 specific issues with the View Holds screen.
>>>
>>> The consortium in question operate as 4 separate authorities when it comes
>>> to holds so there is no interlending between the different systems.  The
>>> Hold Policies are set up to retrospectively block holds from a different
>>> system.  As a result no hold weighting policies or equivalent have been
>>> configured.
>>>
>>> The Patron Opt-In Boundary and Patron Opt-In Default settings have a value
>>> of 1 (system) and I can confirm that this behaves as we would expect in a
>>> patron search - i.e. a search will only find patrons that have a home
>>> library within your org unit tree.
>>>
>>> Our customer's test server is at 2.5.3 where these scenarios persist:
>>>
>>> 1)  There can be a large number of holds on a popular bestseller.  When you
>>> go to the View Holds screen, you see the list of all holds for the entire
>>> consortium.
>>>
>>> There is a filter option which allows you to filter on either   
>>> pickup library
>>> or requesting library but this is a specific branch.  Our customer needs to
>>> be able to see the holds queue for their whole system at once.  It is not
>>> necessary to see the holds for the other systems in the consortium.
>>>
>>> 2)  This is a more serious problem.  Due to the above scenario - i.e. the
>>> ability to see all consortium holds, it has become apparent that you can
>>> access a patron record from another system.  From the View Holds Screen,
>>> highlight a hold and then select 'Retrieve Patron' from the Actions menu.
>>> You are taken straight into the patron record even if this patron   
>>> belongs to
>>> another system (different org unit hierarchy).
>>>
>>> Can anyone shed any light on how to control this please?  This   
>>> customer only
>>> wants to be able to see their own local authority's holds and more
>>> importantly be prevented from being able to access a patron record that
>>> doesn't belong to them.
>>>
>>> Many thanks in advance for any help.
>>>
>>> Fiona
>>>
>>> --
>>>
>>> Fiona Borthwick
>>> Customer Services Consultant, PTFS Europe Limited
>>> Content Management and Library Solutions
>>>
>>> +44 (0) 800 756 6803 (phone)
>>> +44 (0) 7540 768230  (mobile)
>>> +44 (0) 131 2088578  (direct dial)
>>> +44 (0) 800 756 6384 (fax)
>>> fiona.borthwick at ptfs-europe.com
>>> skype: fionaborthwick1
>>>
>>> http://www.ptfs-europe.com
>>
>>
>>
>> --
>> Benjamin Shum
>> Evergreen Systems Manager
>> Bibliomation, Inc.
>> 24 Wooster Ave.
>> Waterbury, CT 06708
>> 203-577-4070, ext. 113
>
>
>
> --
> Mike Rylander
>  | Director of Research and Development
>  | Equinox Software, Inc. / Your Library's Guide to Open Source
>  | phone:  1-877-OPEN-ILS (673-6457)
>  | email:  miker at esilibrary.com
>  | web:  http://www.esilibrary.com
>

Tina Ji
1-888-848-9250
Support Specialist
BC Libraries Cooperative/Sitka