Bug 36570

Summary:	OAI-PMH - Hide items non-public notes
Product:	Koha	Reporter:	Pablo AB <pablo.bianchi>
Component:	Web services	Assignee:	Bugs List <koha-bugs>
Status:	NEW ---	QA Contact:	Testopia <testopia>
Severity:	normal
Priority:	P5 - low	CC:	dcook
Version:	Main
Hardware:	All
OS:	All
See Also:	https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36090
Change sponsored?:	---	Patch complexity:	---
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:
Circulation function:

Description Pablo AB 2024-04-10 20:07:23 UTC

After enabling the expose of items (`include_items: 1` on `OAI-PMH:ConfFile`) the info of 952$x Non-public note (items.itemnotes_nonpublic) is shown, potentially exposing sensitive information.

Not sure how a solution to this issue may interact with OpacHiddenItems.

Comment 1 David Cook 2024-04-11 00:04:47 UTC

I noticed this a few months ago as well. Basically, the OAI-PMH isn't respecting the bibliographic frameworks in general, so other hidden fields would also be shown. 

This does need a fix...

Comment 2 Pablo AB 2024-04-11 00:40:42 UTC

Right! Likewise, I notice data leakage (particularly through 9xx) while using marcxml, since Bug 19353 is relatively recent. Maybe a new syspref could define if the subfield OAI visibility state should honor the OPAC visibility flag (before passing through the XSLT (i.e., any metadataPrefix)). Usually, if the subfield should not be seen by humans, should not be seen by machines also. Could be OAI-PMH:HonorOPACVisibilityFlag.

Or maybe rename the ancient visibility flag "Flagged" to "OAI" (no one knows its purpose, Bug 14772).

Comment 3 David Cook 2024-04-11 00:56:51 UTC

I've also been wondering about adding a system preference like that. 

I suppose another option would be in the OAI config file. For instance, defaulting to honouring the OPAC visibility with an ability to override it on a per metadata format basis. 

That might actually be the best way to do it.