Bug 27604

Summary: PatronSelfRegistrationLibraryList can be bypassed
Product: Koha Reporter: Jonathan Druart <jonathan.druart>
Component: PatronsAssignee: Jonathan Druart <jonathan.druart>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: 1joynelson, fridolin.somers, gmcharlt, jonathan.druart, katrin.fischer, kyle.m.hall, lucas, magnus, martin.renvoize, nick, oleonard, victor
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27710
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
21.05.00,20.11.03,20.05.09,19.11.15
Bug Depends on: 16274    
Bug Blocks:    
Attachments: Bug 27604: Make sure PatronSelfRegistrationLibraryList is used
Bug 27604: Make sure PatronSelfRegistrationLibraryList is used
Bug 27604: Make sure PatronSelfRegistrationLibraryList is used
Bug 27604: (QA follow-up) Limit the libraries during the query
Bug 27604: Init to {}
Bug 27604: Deal with empty pref
Bug 27604: [19.11] Make sure PatronSelfRegistrationLibraryList is used

Description Jonathan Druart 2021-02-03 15:13:50 UTC
The value of PatronSelfRegistrationLibraryList is used to display the dropdown list of the libraries, but not after the form is submitted.
Comment 1 Jonathan Druart 2021-02-03 15:16:44 UTC
Created attachment 116271 [details] [review]
Bug 27604: Make sure PatronSelfRegistrationLibraryList is used

The value of PatronSelfRegistrationLibraryList is used to display the dropdown
list of the libraries, but not after the form is submitted.

Test plan:
1. Empty PatronSelfRegistrationLibraryList
2. Self register a new patron
=> Confirm the dropdown list with the libraries contain all the
libraries
3. Fill in PatronSelfRegistrationLibraryList with branchcodes (eg. "CPL|MPL")
4. Self register a new patron
5. Edit the HTML form and replace the option's value with another
branchcode (FPL)
6. Save
=> Without this patch the branchcode FPL is used
=> With this patch applied an ugly 500 is returned
Comment 2 Lucas Gass 2021-02-03 16:40:01 UTC
Created attachment 116286 [details] [review]
Bug 27604: Make sure PatronSelfRegistrationLibraryList is used

The value of PatronSelfRegistrationLibraryList is used to display the dropdown
list of the libraries, but not after the form is submitted.

Test plan:
1. Empty PatronSelfRegistrationLibraryList
2. Self register a new patron
=> Confirm the dropdown list with the libraries contain all the
libraries
3. Fill in PatronSelfRegistrationLibraryList with branchcodes (eg. "CPL|MPL")
4. Self register a new patron
5. Edit the HTML form and replace the option's value with another
branchcode (FPL)
6. Save
=> Without this patch the branchcode FPL is used
=> With this patch applied an ugly 500 is returned

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Comment 3 Nick Clemens 2021-02-05 17:32:05 UTC
Created attachment 116424 [details] [review]
Bug 27604: Make sure PatronSelfRegistrationLibraryList is used

The value of PatronSelfRegistrationLibraryList is used to display the dropdown
list of the libraries, but not after the form is submitted.

Test plan:
1. Empty PatronSelfRegistrationLibraryList
2. Self register a new patron
=> Confirm the dropdown list with the libraries contain all the
libraries
3. Fill in PatronSelfRegistrationLibraryList with branchcodes (eg. "CPL|MPL")
4. Self register a new patron
5. Edit the HTML form and replace the option's value with another
branchcode (FPL)
6. Save
=> Without this patch the branchcode FPL is used
=> With this patch applied an ugly 500 is returned

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

https://bugs.koha-community.org/show_bug.cgi?id=11983
Comment 4 Nick Clemens 2021-02-05 17:32:08 UTC
Created attachment 116425 [details] [review]
Bug 27604: (QA follow-up) Limit the libraries during the query

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

https://bugs.koha-community.org/show_bug.cgi?id=11983
Comment 5 Jonathan Druart 2021-02-08 13:43:44 UTC
Created attachment 116497 [details] [review]
Bug 27604: Init to {}
Comment 6 Jonathan Druart 2021-02-08 13:58:05 UTC
Pushed to master for 21.05, thanks to everybody involved!
Comment 7 Jonathan Druart 2021-02-16 08:31:06 UTC
Created attachment 116907 [details] [review]
Bug 27604: Deal with empty pref
Comment 8 Jonathan Druart 2021-02-16 09:23:18 UTC
(In reply to Jonathan Druart from comment #7)
> Created attachment 116907 [details] [review] [review]
> Bug 27604: Deal with empty pref

Patch pushed to master.
Comment 9 Victor Grousset/tuxayo 2021-02-18 20:31:03 UTC
tl;dr can't backport to 19.11, help needed with the conflicts


Thanks Andrew for testing on 20.05

As this applies without any issue on 20.05, that means my hope of using the 20.05 version to solve the conflicts won't realize. ^^"


Reply from Fridolin via email
> I see Bug 25136 affects this code, its only in >= 20.05.
> https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25136

Bug 25136 didn't introduced the bug, I can reproduce it on 19.11


> Or maybe try to apply 3 patches squashed as one. 

Same conflict :(
Comment 10 Jonathan Druart 2021-02-19 07:37:34 UTC
Created attachment 117020 [details] [review]
Bug 27604: [19.11] Make sure PatronSelfRegistrationLibraryList is used

The value of PatronSelfRegistrationLibraryList is used to display the dropdown
list of the libraries, but not after the form is submitted.

Test plan:
1. Empty PatronSelfRegistrationLibraryList
2. Self register a new patron
=> Confirm the dropdown list with the libraries contain all the
libraries
3. Fill in PatronSelfRegistrationLibraryList with branchcodes (eg. "CPL|MPL")
4. Self register a new patron
5. Edit the HTML form and replace the option's value with another
branchcode (FPL)
6. Save
=> Without this patch the branchcode FPL is used
=> With this patch applied an ugly 500 is returned

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

https://bugs.koha-community.org/show_bug.cgi?id=11983

Bug 27604: (QA follow-up) Limit the libraries during the query

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

https://bugs.koha-community.org/show_bug.cgi?id=11983

Bug 27604: Init to {}

Bug 27604: Deal with empty pref
Comment 11 Jonathan Druart 2021-02-19 07:38:41 UTC
I picked the code from master and it's working correctly it seems (ie. it embemds bug 25136).
Comment 12 Victor Grousset/tuxayo 2021-02-19 13:29:41 UTC
It works, thanks a lot Jonathan :)
Comment 13 Fridolin Somers 2021-02-23 13:36:42 UTC
Pushed to 20.11.x for 20.11.03
Comment 14 Victor Grousset/tuxayo 2021-02-23 18:09:07 UTC
Backported: Pushed to 19.11.x branch for 19.11.15
Comment 15 Jonathan Druart 2021-02-23 23:18:05 UTC
And pushed to master for 21.05