Bugzilla – Attachment 131590 Details for
Bug 30279
Log when personal data is displayed in staff client
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 30279: Log viewing of personal data in staff client
Bug-30279-Log-viewing-of-personal-data-in-staff-cl.patch (text/plain), 6.00 KB, created by
David Gustafsson
on 2022-03-11 14:32:12 UTC
(
hide
)
Description:
Bug 30279: Log viewing of personal data in staff client
Filename:
MIME Type:
Creator:
David Gustafsson
Created:
2022-03-11 14:32:12 UTC
Size:
6.00 KB
patch
obsolete
>From 13fcce75ebf3ab779ba57bae1cd409d236004b01 Mon Sep 17 00:00:00 2001 >From: David Gustafsson <david.gustafsson@ub.gu.se> >Date: Fri, 11 Mar 2022 13:46:59 +0100 >Subject: [PATCH] Bug 30279: Log viewing of personal data in staff client > >Add possiblilty to log when personal data is viewed by staff >in the web interface. > >To test: >1) Enable the system preference "PatronViewLog" >2) Visit any page where the patron-info sidebar is displayed >3) Verify that an log entry has been created for module "MEMBERS" and action > "VIEW" in the action_logs table >4) Disable the system preference and perform step 2) again >5) Verify that no new log entries for the above module and action has been created > >Sponsored-by: Gothenburg University Library >--- > Koha/Template/Plugin/ViewLog.pm | 43 +++++++++++++++++++ > .../atomicupdate/bug-30279-log-patron-view.pl | 12 ++++++ > installer/data/mysql/mandatory/sysprefs.sql | 1 + > .../prog/en/includes/circ-menu.inc | 2 + > .../en/modules/admin/preferences/logs.pref | 6 +++ > 5 files changed, 64 insertions(+) > create mode 100644 Koha/Template/Plugin/ViewLog.pm > create mode 100755 installer/data/mysql/atomicupdate/bug-30279-log-patron-view.pl > >diff --git a/Koha/Template/Plugin/ViewLog.pm b/Koha/Template/Plugin/ViewLog.pm >new file mode 100644 >index 0000000000..c29c2c077d >--- /dev/null >+++ b/Koha/Template/Plugin/ViewLog.pm >@@ -0,0 +1,43 @@ >+package Koha::Template::Plugin::ViewLog; >+ >+=head1 NAME >+ >+Koha::Template::Plugin::ViewLog - A module for logging when a particular template is rendered and viewed by staff. >+ >+=head1 DESCRIPTION >+ >+This plugin contains methods to log when sensitive information is viewed by staff in order to mitigate or aid in >+investigating GDPR personal data breach incidents. >+ >+=head2 Methods >+ >+=head3 log_patron_view >+ >+[% Desks.log_patron_view(borrowernumber) %] >+ >+Writes to action log that a patron with C<borrowernumber> has been viewd by the current user. >+ >+=cut >+ >+use Modern::Perl; >+use C4::Context; >+use C4::Log qw( logaction ); >+ >+use Template::Plugin; >+use base qw( Template::Plugin ); >+ >+sub log_patron_view { >+ my ($self, $patron_borrowernumber ) = @_; >+ if (C4::Context->preference('PatronViewLog')) { >+ my $ip = $ENV{REMOTE_ADDR}; >+ my $uri = $ENV{REQUEST_URI}; >+ logaction( >+ 'MEMBERS', >+ 'VIEW', >+ $patron_borrowernumber, >+ "borrowernumber: $patron_borrowernumber, ip: $ip, uri: $uri" >+ ); >+ } >+}; >+ >+1; >diff --git a/installer/data/mysql/atomicupdate/bug-30279-log-patron-view.pl b/installer/data/mysql/atomicupdate/bug-30279-log-patron-view.pl >new file mode 100755 >index 0000000000..1c1061c8b7 >--- /dev/null >+++ b/installer/data/mysql/atomicupdate/bug-30279-log-patron-view.pl >@@ -0,0 +1,12 @@ >+use Modern::Perl; >+ >+return { >+ bug_number => "30279", >+ description => "Add' PatronViewLog' system preference", >+ up => sub { >+ my ($args) = @_; >+ my ($dbh, $out) = @$args{qw(dbh out)}; >+ $dbh->do(q{ INSERT IGNORE INTO systempreferences (variable, value, options, explanation, type) VALUES ('PatronViewLog', '0', NULL, 'If enabled, log when patron personal data is viewed in staff interface', 'YesNo') }); >+ say $out "System preference added"; >+ }, >+}; >diff --git a/installer/data/mysql/mandatory/sysprefs.sql b/installer/data/mysql/mandatory/sysprefs.sql >index dd83a00fd8..e47fe8aea6 100644 >--- a/installer/data/mysql/mandatory/sysprefs.sql >+++ b/installer/data/mysql/mandatory/sysprefs.sql >@@ -528,6 +528,7 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` > ('PatronSelfRegistrationPrefillForm','1',NULL,'Display password and prefill login form after a patron has self registered','YesNo'), > ('PatronSelfRegistrationVerifyByEmail','0',NULL,'If enabled, any patron attempting to register themselves via the OPAC will be required to verify themselves via email to activate their account.','YesNo'), > ('PatronsPerPage','20','20','Number of Patrons Per Page displayed by default','Integer'), >+('PatronViewLog','0',NULL,'If enabled, log when patron personal data is viewed in staff interface','YesNo'), > ('PatronQuickAddFields', '', NULL , 'A list of fields separated by "|" to be displayed along with mandatory fields in the patron quick add form if chosen at patron entry', 'Free' ), > ('PhoneNotification','0',NULL,'If ON, enables generation of phone notifications to be sent by plugins','YesNo'), > ('PrefillGuaranteeField', 'phone,email,streetnumber,address,city,state,zipcode,country', NULL, 'Prefill these fields in guarantee member entry form from guarantor patron record', 'Multiple'), >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc >index 824c1c9798..0600e5e2b8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc >@@ -1,7 +1,9 @@ > [% USE Koha %] > [% USE KohaDates %] >+[% USE ViewLog %] > [% PROCESS 'member-display-address-style.inc' %] > [% IF ( patron.borrowernumber ) %] >+[% ViewLog.log_patron_view(patron.borrowernumber) %] > [% SET patron_is_staff = patron.has_permission({ 'catalogue' => 1 }) %] > [% SET patron_is_superlibrarian = patron.is_superlibrarian %] > [% SET patron_type_class = 'is-not-staff' %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/logs.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/logs.pref >index 25849eac0b..52ebfccd17 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/logs.pref >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/logs.pref >@@ -108,6 +108,12 @@ Logging: > 1: Log > 0: "Don't log" > - " changes to news entries and other contents managed in the news tool." >+ - >+ - pref: PatronViewLog >+ choices: >+ 1: Log >+ 0: "Don't log" >+ - " when patron personal information is viewed in the staff interface." > Debugging: > - > - pref: DumpTemplateVarsIntranet >-- >2.34.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 30279
:
131589
|
131590
|
131653
|
132604
|
132605