Bug 12873 - Reserve can be cancelled by any logged in user

It is possible to cancel reservations through simply running opac-modreserve.pl with existing reserve_id number. This may provide remove even all reservations from system. The only limitation is that user have to be logged in. Simplest solution is to check whether reserve belongs to user or not.

Test plan:
1. Create reserves by 2 different users, and get their ID's
2. Before patch, hold may by cancelled by anyone who run site:
http://example.com/cgi-bin/koha/opac-modrequest.pl?reserve_id=XXX
3. After patch hold may by cancelled only by user whose reserve is.

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 12876 - Reserve in waiting/transfer status may be cancelled by user

User may cancel his own reservation at waiting or in transit status
through calling opac-modrequest.pl. Cancel button is disabled in
interface but possibility to cancel should be checked also in
opac-moderequest.pl, before calling CancelReserve().
Similar situation is with opac-modrequest-suspend.pl

This patch provides new soubroutine to chceck if user can cancel given
reserve. It's possible only when he's owner of hold and hold isn't in
transfer or waiting status.

Additionaly there are new test for this function in Reserves.t

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes all tests, QA script and new tests.
Works as described, tested with:
.../cgi-bin/koha/opac-modrequest.pl?reserve_id=XXX

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 12876: Improve unit tests for CanReserveBeCanceledFromOpac

This patch fix the subroutine name and add a restriction on the
arguments: both argument are mandatory!

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 12876: (followup) remove useless diags

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 12937: Deleting suggestions should ask for a confirmation

On the suggestion management page, the librarian can choose to delete
suggestions but no confirmation is needed.
This could produce unexpected lost of data.

Test plan:
- go on the suggestion management page
- don't select any suggestion and try to delete (check the checkbox and submit the form).
  Verify that you get an alert.
- select 1 suggestion and delete it, verify you get a confirmation
  message
- select 1+ suggestions and delete it, verify you get a confirmation
  message

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 12937 [Follow-up] Deleting suggestions should ask for a confirmation

This minor follow-up revises the language a bit: Adding missing question
marks and using the more standard prompt "Please select at least one..."

To test, follow the previous test plan and confirm that the prompts are
improved:

- go on the suggestion management page
- don't select any suggestion and try to delete (check the checkbox and
  submit the form). Verify that you get an alert.
- select 1 suggestion and delete it, verify you get a confirmation
  message
- select 1+ suggestions and delete it, verify you get a confirmation
  message

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>