To reproduce: 1) In staff client, set System preference 'RequestOnOpac' to 'Allow patrons to place holds on items from the OPAC.' 2) Log in to OPAC with a patron' credentials, search a record, place hold without confirming, copy URL, something like [YOUR SERVER]/cgi-bin/koha/opac-reserve.pl?biblionumbers=1 3) In staff client, set System preference 'RequestOnOpac' to 'Don't allow patrons to place holds on items from the OPAC.' 4) Log out. Log in again in OPAC. 5) Paste URL in browser's address bar Result: Page displays, you can put a hold on the requested item. Expected: 404 page, similar to solution for Bug 12703
Created attachment 37274 [details] [review] OPAC: Putting holds still possible by URL even if turned off by system preference To test: 1) Prepare an URL that put's a hold in OPAC (see comment #1), e.g. [YOUR SERVER]/cgi-bin/koha/opac-reserve.pl?biblionumbers=1 2) Set system preference 'RequestOnOpac' to 'Don't allow patrons to place holds on items from the OPAC.' 3) Go diectly to this URL. Result: The page displays to confirm hold (wrong) 4) Apply patch 5) Repeat step 3 Result: Redirect to 404 page (OK) 6) Set system preference to "Allow" 7) Repeat step 3 Result: The page displays to confirm hold (OK), like it would be from link in OPAC.
Re-tested, still applies.
Created attachment 37717 [details] [review] Bug 13917: OPAC: Putting holds still possible by URL even if turned off by system preference To test: 1) Prepare an URL that put's a hold in OPAC (see comment #1), e.g. [YOUR SERVER]/cgi-bin/koha/opac-reserve.pl?biblionumbers=1 2) Set system preference 'RequestOnOpac' to 'Don't allow patrons to place holds on items from the OPAC.' 3) Go diectly to this URL. Result: The page displays to confirm hold (wrong) 4) Apply patch 5) Repeat step 3 Result: Redirect to 404 page (OK) 6) Set system preference to "Allow" 7) Repeat step 3 Result: The page displays to confirm hold (OK), like it would be from link in OPAC. Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Hum, I would raise the severity to major for this one.
Created attachment 37917 [details] [review] [PASSED QA] Bug 13917: OPAC: Putting holds still possible by URL even if turned off by system preference To test: 1) Prepare an URL that put's a hold in OPAC (see comment #1), e.g. [YOUR SERVER]/cgi-bin/koha/opac-reserve.pl?biblionumbers=1 2) Set system preference 'RequestOnOpac' to 'Don't allow patrons to place holds on items from the OPAC.' 3) Go diectly to this URL. Result: The page displays to confirm hold (wrong) 4) Apply patch 5) Repeat step 3 Result: Redirect to 404 page (OK) 6) Set system preference to "Allow" 7) Repeat step 3 Result: The page displays to confirm hold (OK), like it would be from link in OPAC. Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
I think if we look really close... we'd find more features that need this kind of fix - thx for the patch!
Patch pushed to master. Nice catch Marc!
Pushed to 3.18.x will be in 3.18.6