Bug 22646

Summary: Fix use of PrivacyPolicyURL
Product: Koha Reporter: Magnus Enger <magnus>
Component: PatronsAssignee: Magnus Enger <magnus>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: gmcharlt, katrin.fischer, kyle.m.hall, lucas, martin.renvoize, nick
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
19.05.00, 18.11.05
Bug Depends on: 20819    
Bug Blocks:    
Attachments: Bug 22646 - Fix use of PrivacyPolicyURL
Bug 22646: Fix use of PrivacyPolicyURL
Bug 22646: Fix use of PrivacyPolicyURL
Bug 22646: Fix use of PrivacyPolicyURL

Description Magnus Enger 2019-04-05 07:48:13 UTC
Bug 20819 introduced two new sysprefs: GDPR_Policy and PrivacyPolicyURL. The latter is used in a couple of places in the code: 

* koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-patron-consent.tt, line 44:

 38 [% IF Koha.Preference('GDPR_Policy') %]
 ...
 44 <p>I have read the <a target="_blank" href="[% Koha.Preference('PrivacyPolicyURL') | url %]">privacy policy</a> and agree with your processing of my personal data as outlined therein.</p>

* koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt, line 906:

 901 [% IF Koha.Preference('GDPR_Policy') && action != 'edit' %]
 ...
 906 <label></label><span><input type="checkbox" name="borrower_gdpr_proc_consent" value="agreed"> I agree with your processing of my personal data as outlined in the <a target="_blank" href="[% PrivacyPolicyURL | url %]">privacy policy</a>. <span class="required">Required</span></span>

Two problems here:

1. The second occurence forgets to do Koha.Preference('PrivacyPolicyURL'), so no URL is included in the page

2. Neither occurence checks if PrivacyPolicyURL is defined before using it, but the description of PrivacyPolicyURL does not say that it is mandatory if GDPR_Policy is defined. So do we check if PrivacyPolicyURL is defined before displaying the link, or do we say that PrivacyPolicyURL is mandatory if GDPR_Policy is set? Personally I am under the impression that having a public privacy policy is part of being GDPR compliant, so I will submit a patch that adds a "mandatory" text to the sysprefs.
Comment 1 Magnus Enger 2019-04-05 08:05:40 UTC
Created attachment 87439 [details] [review]
Bug 22646 - Fix use of PrivacyPolicyURL

To test:

PatronSelfRegistration = Allow
PatronSelfRegistrationDefaultCategory = PT (or some other real category)
GDPR_Policy = Enforced
PrivacyPolicyURL = Some URL

- Go to <opac>/cgi-bin/koha/opac-memberentry.pl and verify that the text "privacy
  policy" displays a link to the current page, not the URL in PrivacyPolicyURL
- Go to Administration > System preferences > Patrons > Privacy
- Verify that the descriptions of GDPR_Policy and PrivacyPolicyURL does not
  mention that PrivacyPolicyURL needs to be set if GDPR_Policy is set.
- Apply the patch
- Verify that opac-memberentry.pl now links to the URL in PrivacyPolicyURL
- Verify that the syspref descriptions mention the relationship between them
Comment 2 Liz Rea 2019-04-05 15:07:35 UTC
Created attachment 87452 [details] [review]
Bug 22646: Fix use of PrivacyPolicyURL

To test:

PatronSelfRegistration = Allow
PatronSelfRegistrationDefaultCategory = PT (or some other real category)
GDPR_Policy = Enforced
PrivacyPolicyURL = Some URL

- Go to <opac>/cgi-bin/koha/opac-memberentry.pl and verify that the text "privacy
  policy" displays a link to the current page, not the URL in PrivacyPolicyURL
- Go to Administration > System preferences > Patrons > Privacy
- Verify that the descriptions of GDPR_Policy and PrivacyPolicyURL does not
  mention that PrivacyPolicyURL needs to be set if GDPR_Policy is set.
- Apply the patch
- Verify that opac-memberentry.pl now links to the URL in PrivacyPolicyURL
- Verify that the syspref descriptions mention the relationship between them

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Fixed commit message.
Comment 3 Bin Wen 2019-04-05 17:57:18 UTC
Created attachment 87454 [details] [review]
Bug 22646: Fix use of PrivacyPolicyURL

To test:

PatronSelfRegistration = Allow
PatronSelfRegistrationDefaultCategory = PT (or some other real category)
GDPR_Policy = Enforced
PrivacyPolicyURL = Some URL

- Go to <opac>/cgi-bin/koha/opac-memberentry.pl and verify that the text "privacy
  policy" displays a link to the current page, not the URL in PrivacyPolicyURL
- Go to Administration > System preferences > Patrons > Privacy
- Verify that the descriptions of GDPR_Policy and PrivacyPolicyURL does not
  mention that PrivacyPolicyURL needs to be set if GDPR_Policy is set.
- Apply the patch
- Verify that opac-memberentry.pl now links to the URL in PrivacyPolicyURL
- Verify that the syspref descriptions mention the relationship between them

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Signed-off-by: Bin Wen <bin.wen@inlibro.com>
Comment 4 Katrin Fischer 2019-04-06 10:00:55 UTC
Created attachment 87468 [details] [review]
Bug 22646: Fix use of PrivacyPolicyURL

To test:

PatronSelfRegistration = Allow
PatronSelfRegistrationDefaultCategory = PT (or some other real category)
GDPR_Policy = Enforced
PrivacyPolicyURL = Some URL

- Go to <opac>/cgi-bin/koha/opac-memberentry.pl and verify that the text "privacy
  policy" displays a link to the current page, not the URL in PrivacyPolicyURL
- Go to Administration > System preferences > Patrons > Privacy
- Verify that the descriptions of GDPR_Policy and PrivacyPolicyURL does not
  mention that PrivacyPolicyURL needs to be set if GDPR_Policy is set.
- Apply the patch
- Verify that opac-memberentry.pl now links to the URL in PrivacyPolicyURL
- Verify that the syspref descriptions mention the relationship between them

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Signed-off-by: Bin Wen <bin.wen@inlibro.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 5 Nick Clemens (kidclamp) 2019-04-10 20:15:24 UTC
Awesome work all!

Pushed to master for 19.05
Comment 6 Martin Renvoize 2019-04-15 11:37:07 UTC
Pushed to 18.11.x for 18.11.05
Comment 7 Lucas Gass 2019-04-16 21:11:50 UTC
missing dependencies for 18.05.x, not backporting