Bug 22370 - OPAC users should not be allowed to view staff news items
Summary: OPAC users should not be allowed to view staff news items
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: master
Hardware: All All
: P5 - low major (vote)
Assignee: Aleisha Amohia
QA Contact: Testopia
URL:
Keywords:
Depends on: 14272
Blocks:
  Show dependency treegraph
 
Reported: 2019-02-19 13:57 UTC by Nick Clemens
Modified: 2020-01-06 20:14 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 22370: Prevent OPAC users from seeing staff news from URL (1.22 KB, patch)
2019-02-19 21:06 UTC, Aleisha Amohia
Details | Diff | Splinter Review
Bug 22370: Prevent OPAC users from seeing staff news from URL (1.28 KB, patch)
2019-02-27 20:35 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 22370: Prevent OPAC users from seeing staff news from URL (1.34 KB, patch)
2019-02-28 06:42 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens 2019-02-19 13:57:07 UTC
To recreate:
1 - Have some opac and staff only news items
2 - On the opac view a single news item
3 - Change the id in the link to the id of the staff item
4 - View the staff news on the opac? not good
Comment 1 Aleisha Amohia 2019-02-19 21:06:56 UTC
Created attachment 85314 [details] [review]
Bug 22370: Prevent OPAC users from seeing staff news from URL

To test:
1) Have some OPAC and staff only news items
2) On the OPAC view a single news item
3) Change the ID in the URL to the ID of a staff news item
4) Notice you can view the news item without any problems
5) Apply the patch and refresh the page
6) An error should show that the news item doesn't exist
7) Confirm you can still view OPAC news items individually

Sponsored-by: Catalyst IT
Comment 2 Josef Moravec 2019-02-27 20:35:08 UTC
Created attachment 85797 [details] [review]
Bug 22370: Prevent OPAC users from seeing staff news from URL

To test:
1) Have some OPAC and staff only news items
2) On the OPAC view a single news item
3) Change the ID in the URL to the ID of a staff news item
4) Notice you can view the news item without any problems
5) Apply the patch and refresh the page
6) An error should show that the news item doesn't exist
7) Confirm you can still view OPAC news items individually

Sponsored-by: Catalyst IT

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 3 Katrin Fischer 2019-02-28 06:42:00 UTC
Created attachment 85804 [details] [review]
Bug 22370: Prevent OPAC users from seeing staff news from URL

To test:
1) Have some OPAC and staff only news items
2) On the OPAC view a single news item
3) Change the ID in the URL to the ID of a staff news item
4) Notice you can view the news item without any problems
5) Apply the patch and refresh the page
6) An error should show that the news item doesn't exist
7) Confirm you can still view OPAC news items individually

Sponsored-by: Catalyst IT

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 4 Nick Clemens 2019-03-04 18:49:19 UTC
Awesome work all!

Pushed to master for 19.05
Comment 5 Martin Renvoize 2019-03-05 14:42:44 UTC
Bug against enhancement for 19.05.