The page for accessing the OPAC search history should not be accessible if the system preference EnableOpacSearchHistory is set to "Don't keep". To test: - Turn off EnableOpacSearchHistory - Try to access .../cgi-bin/koha/opac-search-history.pl
Is this still the case?
Still valid. To reproduce: - In staff client, Turn EnableOpacSearchHistory to 'Keep' - Log in to the OPAC - Do some seaches - In OPAC, go to the Search history page (link top right) - Verify that search history appears - Copy link from browser address bar (.../cgi-bin/koha/opac-search-history.pl) - Turn EnableOpacSearchHistory to "Don't keep" - Log in again to OPAC - Verify that link to search history does no longer appear - Paste saved link in address bar - Page with search history appears - should not.
On additional issue is that if you have activated search history on the opac, and have an opac set to private via opacpublic, then patrons can only access their search history if they have the permission to manage borrowers. To reproduce : - set your opac to private via opacpublic - activate EnableOpacSearchHistory - log in your private opac with a user that has no permissions for the staff interface - search for something in the catalog - the link for search history is now visible, but if you click on it, you will get an access denied message - log in to your private opac with a user that has the "borrowers" permission - repeat above steps : you can now access your search history. Since this issue and the fact that the url still responds when the syspref is turned off, when it should display an access denied page, can be fixed in the same block of code, we will offer a patch for both issues at once.
Created attachment 69313 [details] [review] Bug 12497: Fix search history non-accessible when OPAC was private (when the user didn't have the "borrowers" permission) Test plan: 1. Set syspref "OpacPublic" to false (Disable) 2. Log in as a user without any permission 3. Try to access the search history. The link is next to "Log out" 4. Then you should see "Access denied" 5. Apply this patch 6. Refresh the page 7. Then you should see the search history
Origin of the permission issue on a private OPAC ("borrowers" permission required): http://git.koha-community.org/gitweb/?p=koha.git;a=blob;f=opac/opac-search-history.pl;h=fdf0701be32e7ebc4e6ef8198d460c820e228b0a;hb=feeafa8168965183ba8651cf3113c3c32af863ec#l42 http://git.koha-community.org/gitweb/?p=koha.git;a=commit;h=feeafa8168965183ba8651cf3113c3c32af863ec
Created attachment 69334 [details] [review] Bug 12497: Fix OPAC search history reachable by URL even when disabled Test plan: 1. Set EnableOpacSearchHistory syspref to "Keep" 2. Make a search in the OPAC 3. Go to /cgi-bin/koha/opac-search-history.pl 4. Set the EnableOpacSearchHistory syspref to "Don't keep" 5. Refresh the OPAC page to show that history is still accessible 6. Apply the patch 7. Refresh the OPAC page, you should end on the 404 page 8. Set EnableOpacSearchHistory syspref to "Keep" 9. Go to /cgi-bin/koha/opac-search-history.pl which should be reachable
Created attachment 69339 [details] [review] Bug 12497: Fix search history non-accessible when OPAC was private (when the user didn't have the "borrowers" permission) Test plan: 1. Set syspref "OpacPublic" to false (Disable) 2. Log in as a user without any permission 3. Try to access the search history. The link is next to "Log out" 4. Then you should see "Access denied" 5. Apply this patch 6. Refresh the page 7. Then you should see the search history Signed-off-by: David Bourgault <david.bourgault@inlibro.com>
Created attachment 69340 [details] [review] Bug 12497: Fix OPAC search history reachable by URL even when disabled Test plan: 1. Set EnableOpacSearchHistory syspref to "Keep" 2. Make a search in the OPAC 3. Go to /cgi-bin/koha/opac-search-history.pl 4. Set the EnableOpacSearchHistory syspref to "Don't keep" 5. Refresh the OPAC page to show that history is still accessible 6. Apply the patch 7. Refresh the OPAC page, you should end on the 404 page 8. Set EnableOpacSearchHistory syspref to "Keep" 9. Go to /cgi-bin/koha/opac-search-history.pl which should be reachable Signed-off-by: David Bourgault <david.bourgault@inlibro.com>
Is this intended behavior to return a 404 whenever a systempreference blocks a page in Koha? I feel like the template could simply state to users and admin alike that search history is disabled, unless that's deemed too verbose for the user's own good. But it works, nonetheless, so I'm signing it off.
Created attachment 69341 [details] [review] Bug 12497: Fix search history non-accessible when OPAC was private (when the user didn't have the "borrowers" permission) Test plan: 1. Set syspref "OpacPublic" to false (Disable) 2. Log in as a user without any permission 3. Try to access the search history. The link is next to "Log out" 4. Then you should see "Access denied" 5. Apply this patch 6. Refresh the page 7. Then you should see the search history Signed-off-by: David Bourgault <david.bourgault@inlibro.com> Signed-off-by: Charles Farmer <charles.farmer@inLibro.com>
Created attachment 69342 [details] [review] Bug 12497: Fix OPAC search history reachable by URL even when disabled Test plan: 1. Set EnableOpacSearchHistory syspref to "Keep" 2. Make a search in the OPAC 3. Go to /cgi-bin/koha/opac-search-history.pl 4. Set the EnableOpacSearchHistory syspref to "Don't keep" 5. Refresh the OPAC page to show that history is still accessible 6. Apply the patch 7. Refresh the OPAC page, you should end on the 404 page 8. Set EnableOpacSearchHistory syspref to "Keep" 9. Go to /cgi-bin/koha/opac-search-history.pl which should be reachable Signed-off-by: David Bourgault <david.bourgault@inlibro.com> Signed-off-by: Charles Farmer <charles.farmer@inLibro.com>
(In reply to Charles Farmer from comment #9) > Is this intended behavior to return a 404 whenever a systempreference blocks > a page in Koha? I feel like the template could simply state to users and > admin alike that search history is disabled, unless that's deemed too > verbose for the user's own good. > > But it works, nonetheless, so I'm signing it off. You will find more examples like: if ( ! C4::Context->preference('suggestion') ) { print $input->redirect("/cgi-bin/koha/errors/404.pl"); exit; } But you are right, nice is something else :)
Created attachment 69380 [details] [review] Bug 12497: Fix search history non-accessible when OPAC was private (when the user didn't have the "borrowers" permission) Test plan: 1. Set syspref "OpacPublic" to false (Disable) 2. Log in as a user without any permission 3. Try to access the search history. The link is next to "Log out" 4. Then you should see "Access denied" 5. Apply this patch 6. Refresh the page 7. Then you should see the search history Signed-off-by: David Bourgault <david.bourgault@inlibro.com> Signed-off-by: Charles Farmer <charles.farmer@inLibro.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 69381 [details] [review] Bug 12497: Fix OPAC search history reachable by URL even when disabled Test plan: 1. Set EnableOpacSearchHistory syspref to "Keep" 2. Make a search in the OPAC 3. Go to /cgi-bin/koha/opac-search-history.pl 4. Set the EnableOpacSearchHistory syspref to "Don't keep" 5. Refresh the OPAC page to show that history is still accessible 6. Apply the patch 7. Refresh the OPAC page, you should end on the 404 page 8. Set EnableOpacSearchHistory syspref to "Keep" 9. Go to /cgi-bin/koha/opac-search-history.pl which should be reachable Signed-off-by: David Bourgault <david.bourgault@inlibro.com> Signed-off-by: Charles Farmer <charles.farmer@inLibro.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Patch has been pushed to master for 18.05. Congratulations Victor for your first patch in!
Pushed to stable for 17.11.01, awesome work all!
Pushed to 17.05.x, will be in v17.05.07
Chris, could you consider this for 16.11.x? We've just run into it and borrowers permission on opac-search-history.pl makes no sense.