Bug 17218

Summary: New list add attempt while logged in as dbadmin on staff side should be prevented pre-emptively
Product: Koha Reporter: Indranil Das Gupta <indradg>
Component: ListsAssignee: Aleisha Amohia <aleisha>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: aleisha, fridolin.somers, katrin.fischer, m.de.rooy, mtompset
Version: 17.11   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20489
Change sponsored?: Sponsored Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 17218: Stop DB user from clicking 'New list' button
Bug 17218: [FOLLOW-UP] Stop DB user from adding list by forcing URL
Bug 17218: Stop DB user from clicking 'New list' button
Bug 17218: [FOLLOW-UP] Stop DB user from adding list by forcing URL
Bug 17218: Stop DB user from clicking 'New list' button
Bug 17218: [FOLLOW-UP] Stop DB user from adding list by forcing URL
Bug 17218: [FOLLOW-UP] Removing pointless code and putting checks in missed places
Bug 17218: Stop DB user from clicking 'New list' button
Bug 17218: [FOLLOW-UP] Stop DB user from adding list by forcing URL
Bug 17218: [FOLLOW-UP] Removing pointless code and putting checks in missed places

Description Indranil Das Gupta 2016-08-29 17:54:33 UTC
Right now it allows the Koha db admin login to attempt adding a new list. Only while trying to save it does it inform that it is not possible to do so. This is should be made pre-emptive right after the "+ New list" option is clicked.
Comment 1 Aleisha Amohia 2017-04-19 02:35:12 UTC
Created attachment 62348 [details] [review]
Bug 17218: Stop DB user from clicking 'New list' button

To test:
1) Log in as DB user
2) Go to Lists -> New list
3) Attempt to create a new list
4) Notice that you are only stopped once you've submitted the form
5) Go back to lists, apply patch and refresh page
6) Notice the 'New list' button is now disabled
7) Click it and confirm alert shows up

Sponsored-by: Catalyst IT
Comment 2 Owen Leonard 2017-08-29 15:20:37 UTC
This works well (although it needs a quick rebase). But I think there should also be a warning on the list add page (/virtualshelves/shelves.pl?op=add_form&referer=add_form) in case the user navigates directly to it.
Comment 3 Aleisha Amohia 2017-08-29 21:43:06 UTC
Created attachment 66604 [details] [review]
Bug 17218: [FOLLOW-UP] Stop DB user from adding list by forcing URL

To test:
1) Go to the url /virtualshelves/shelves.pl?op=add_form&referer=add_form
2) Confirm an error message shows and the Save button cannot be clicked

Sponsored-by: Catalyst IT
Comment 4 Katrin Fischer 2017-10-15 08:21:54 UTC
Created attachment 68155 [details] [review]
Bug 17218: Stop DB user from clicking 'New list' button

To test:
1) Log in as DB user
2) Go to Lists -> New list
3) Attempt to create a new list
4) Notice that you are only stopped once you've submitted the form
5) Go back to lists, apply patch and refresh page
6) Notice the 'New list' button is now disabled
7) Click it and confirm alert shows up

Sponsored-by: Catalyst IT

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 5 Katrin Fischer 2017-10-15 08:21:57 UTC
Created attachment 68156 [details] [review]
Bug 17218: [FOLLOW-UP] Stop DB user from adding list by forcing URL

To test:
1) Go to the url /virtualshelves/shelves.pl?op=add_form&referer=add_form
2) Confirm an error message shows and the Save button cannot be clicked

Sponsored-by: Catalyst IT

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 6 Katrin Fischer 2017-10-15 08:22:17 UTC
I didn't realize at first that this was for the staff side. :)
Comment 7 Aleisha Amohia 2018-03-01 01:03:26 UTC
Created attachment 72298 [details] [review]
Bug 17218: Stop DB user from clicking 'New list' button

To test:
1) Log in as DB user
2) Go to Lists -> New list
3) Attempt to create a new list
4) Notice that you are only stopped once you've submitted the form
5) Go back to lists, apply patch and refresh page
6) Notice the 'New list' button is now disabled
7) Click it and confirm alert shows up

Sponsored-by: Catalyst IT

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 8 Aleisha Amohia 2018-03-01 01:03:32 UTC
Created attachment 72299 [details] [review]
Bug 17218: [FOLLOW-UP] Stop DB user from adding list by forcing URL

To test:
1) Go to the url /virtualshelves/shelves.pl?op=add_form&referer=add_form
2) Confirm an error message shows and the Save button cannot be clicked

Sponsored-by: Catalyst IT

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 9 Mark Tompsett 2018-03-01 19:27:42 UTC
Comment on attachment 72298 [details] [review]
Bug 17218: Stop DB user from clicking 'New list' button

Review of attachment 72298 [details] [review]:
-----------------------------------------------------------------

::: koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc
@@ +10,5 @@
> +        });
> +    [% END %]
> +});
> +
> +[% IF op == 'view' %]

I don't understand this whole IF block's purpose. It seems like new unrelated code.
Comment 10 Mark Tompsett 2018-03-01 19:49:45 UTC
http://localhost:8081/cgi-bin/koha/virtualshelves/addbybiblionumber.pl?newshelf=1&biblionumber=1

When you view the contents of an existing public list, there is a drop-down to add to cart or a new list. That creates a bunch of possible explosion points,
like the kohadevbox link above.
Comment 11 Aleisha Amohia 2018-03-07 03:07:49 UTC
Created attachment 72495 [details] [review]
Bug 17218: [FOLLOW-UP] Removing pointless code and putting checks in missed places

To test:
1) Log in as admin
2) View contents of a public list
3) Click drop-down for 'Add to' - there should be no [New list] option
4) Click on an item in the list
5) Click drop-down for 'Add to' in nav bar, click List
6) There should be no option to add a new list in the pop-up window
7) Do a catalog search that will return multiple results
8) Click drop-down for 'Add to list' - there should be no New list
option

Sponsored-by: Catalyst IT
Comment 12 Mark Tompsett 2018-03-07 15:57:13 UTC
Created attachment 72506 [details] [review]
Bug 17218: Stop DB user from clicking 'New list' button

To test:
1) Log in as DB user
2) Go to Lists -> New list
3) Attempt to create a new list
4) Notice that you are only stopped once you've submitted the form
5) Go back to lists, apply patch and refresh page
6) Notice the 'New list' button is now disabled
7) Click it and confirm alert shows up

Sponsored-by: Catalyst IT

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Comment 13 Mark Tompsett 2018-03-07 15:57:16 UTC
Created attachment 72507 [details] [review]
Bug 17218: [FOLLOW-UP] Stop DB user from adding list by forcing URL

To test:
1) Go to the url /virtualshelves/shelves.pl?op=add_form&referer=add_form
2) Confirm an error message shows and the Save button cannot be clicked

Sponsored-by: Catalyst IT

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Comment 14 Mark Tompsett 2018-03-07 15:57:18 UTC
Created attachment 72508 [details] [review]
Bug 17218: [FOLLOW-UP] Removing pointless code and putting checks in missed places

To test:
1) Log in as admin
2) View contents of a public list
3) Click drop-down for 'Add to' - there should be no [New list] option
4) Click on an item in the list
5) Click drop-down for 'Add to' in nav bar, click List
6) There should be no option to add a new list in the pop-up window
7) Do a catalog search that will return multiple results
8) Click drop-down for 'Add to list' - there should be no New list
option

Sponsored-by: Catalyst IT

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Comment 15 Mark Tompsett 2018-03-07 15:59:21 UTC
NOTE: Javascript error, text/javascript in script tag not necessary for HTML5, and unless can get alert working I'll live with the disorienting click loading a page from a disabled button.
Comment 16 Marcel de Rooy 2018-04-20 06:32:31 UTC
Moving to BLOCKED, since bug 20489 will no longer allow DB admin logins.
Comment 17 Katrin Fischer 2018-10-27 11:46:57 UTC
I believe this is resolved with bug 20489.
Comment 18 Mark Tompsett 2018-10-29 18:44:36 UTC
I've added the 17.11 RM, Fridolin Somers, to this bug. I'll let the RM decide if this is worthy of leaving as Resolved Fixed, or whether this should be put into 17.11, because if we still have an RM for 17.11, then the issue was not resolved in all supported versions.
Comment 19 Fridolin Somers 2018-11-05 11:41:18 UTC
(In reply to M. Tompsett from comment #18)
> I've added the 17.11 RM, Fridolin Somers, to this bug. I'll let the RM
> decide if this is worthy of leaving as Resolved Fixed, or whether this
> should be put into 17.11, because if we still have an RM for 17.11, then the
> issue was not resolved in all supported versions.

Indeed, i'm on RMaint for 17.11, but this is a real enhancement so I decide not to backport.