Summary: | Do not allow reading records of anonymous patron | ||
---|---|---|---|
Product: | Koha | Reporter: | Fridolin Somers <fridolin.somers> |
Component: | Patrons | Assignee: | Fridolin Somers <fridolin.somers> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | major | ||
Priority: | P5 - low | CC: | brendan, cedric.vita, gmcharlt, kyle.m.hall |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12345 | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | Trivial patch | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: | Circulation function: | ||
Attachments: |
Bug 11009 - Do not allow reading records of anonymous patron
Bug 11009 - Add hardcoded limit to OPAC reading records [SIGNED-OFF] Bug 11009 - Do not allow reading records of anonymous patron [PASSED-QA] Bug 11009 - Do not allow reading records of anonymous patron |
Description
Fridolin Somers
2013-10-07 15:32:07 UTC
Created attachment 21896 [details] [review] Bug 11009 - Do not allow reading records of anonymous patron See commit message Each reading record will fetch from database all columns of biblio, biblioitems (including marcxml), items and issues or old_issues. So if there are a great number of reading records, the page may create a heavy load on server. Considering the page exists at OPAC, this may be used to overload the server. So I created a follow-up that adds an hardcoded limit to reading records. Created attachment 21898 [details] [review] Bug 11009 - Add hardcoded limit to OPAC reading records See commit message After applying the patch : http://pro.test1.biblibre.com/cgi-bin/koha/members/member.pl Software error: Base class package "DBIx::Class::Schema" is empty. (Perhaps you need to 'use' the module which defines that package first, or make that module available in @INC (@INC contains: /home/koha/src /etc/perl /usr/local/lib/perl/5.10.1 /usr/local/share/perl/5.10.1 /usr/lib/perl5 /usr/share/perl5 /usr/lib/perl/5.10 /usr/share/perl/5.10 /usr/local/lib/site_perl .). at /home/koha/src/Koha/Schema.pm line 10 BEGIN failed--compilation aborted at /home/koha/src/Koha/Schema.pm line 10. Compilation failed in require at /home/koha/src/Koha/Database.pm line 38. BEGIN failed--compilation aborted at /home/koha/src/Koha/Database.pm line 38. Compilation failed in require at /home/koha/src/Koha/List/Patron.pm line 32. BEGIN failed--compilation aborted at /home/koha/src/Koha/List/Patron.pm line 32. Compilation failed in require at /home/koha/src/members/member.pl line 35. BEGIN failed--compilation aborted at /home/koha/src/members/member.pl line 35. (In reply to cedric.vita from comment #4) > After applying the patch : > Base class package "DBIx::Class::Schema" is empty. This is because the DBIx::Class::Schema::Loarder, package libdbix-class-schema-loader-perl must be installed. I have installed it on all sandboxes. Please retest. I think it would be better to have a widget or choice in the staff side for the user to choose the limit of reading records to show for anonymous patron and then have the fall back to the hardcoded limit ? 500 : 50 Comment on attachment 21898 [details] [review] Bug 11009 - Add hardcoded limit to OPAC reading records Set has obsolete, should be in another bug I removed follow-up (addind OPAC limit) so that this bug can focus on the anonymous patron problem. This follow-up may be used for a new bug. I've set this as major because it may really block the server. Created attachment 22931 [details] [review] [SIGNED-OFF] Bug 11009 - Do not allow reading records of anonymous patron When using an anonymous patron to anonymise issues history, this patron may have a huge number of old issues. In this case, trying to display the reading history of this patron will perform a huge SQL query. It is not usefull to have the reading history of this anonymous patron. This patch adds an alert instead of old issues when displaying reading records of anonymous patron. Test plan : - Set syspref AnonymousPatron to 0. - Select a borrower with old issues. For example 123. - Look at its reading records page : members/readingrec.pl => Old issues are displayed in a datatable - Set syspref AnonymousPatron with this borrower number. For example 123. - Look at its reading records page => Old issues are not displayed and an alert is displayed - Using SQL query, remove old issues of this borrower : DELETE FROM old_issues WHERE borrowernumber=123. - Look at its reading records page => A message is displayed Signed-off-by: Owen Leonard <oleonard@myacpl.org> This works as advertised and seems like a reasonable thing to do. I suspect that someone will object... Perhaps that person will implement a solution which uses an AJAX DataTable. Created attachment 22977 [details] [review] [PASSED-QA] Bug 11009 - Do not allow reading records of anonymous patron When using an anonymous patron to anonymise issues history, this patron may have a huge number of old issues. In this case, trying to display the reading history of this patron will perform a huge SQL query. It is not usefull to have the reading history of this anonymous patron. This patch adds an alert instead of old issues when displaying reading records of anonymous patron. Test plan : - Set syspref AnonymousPatron to 0. - Select a borrower with old issues. For example 123. - Look at its reading records page : members/readingrec.pl => Old issues are displayed in a datatable - Set syspref AnonymousPatron with this borrower number. For example 123. - Look at its reading records page => Old issues are not displayed and an alert is displayed - Using SQL query, remove old issues of this borrower : DELETE FROM old_issues WHERE borrowernumber=123. - Look at its reading records page => A message is displayed Signed-off-by: Owen Leonard <oleonard@myacpl.org> This works as advertised and seems like a reasonable thing to do. I suspect that someone will object... Perhaps that person will implement a solution which uses an AJAX DataTable. Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com> This reminds me of the old joke: "Doctor, it hurts when I do this!" "Well, stop doing it then!" Anyway, pushed to master -- though I would not be entirely surprised if somebody will end up wanting to be able to display a list of anonymized loans. Thanks, Fridolin! Patches pushed to 3.14.x, will be in 3.14.2. |