Bug 36965

Summary: Self-registration category selection should be limited
Product: Koha Reporter: David Cook <dcook>
Component: OPACAssignee: Owen Leonard <oleonard>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low    
Version: Main   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:

Description David Cook 2024-05-27 02:17:24 UTC
At the moment, if categorycode isn't hidden, you can self-register as a library staff member. That shouldn't be possible.

At the moment, since permissions aren't assigned, they can't log in as a library staff member, but it's not a good look. Technically speaking, someone really clever could probably also do bad things with this.

(Locally for many years we've provided a syspref to restrict the available categories.)
Comment 1 Katrin Fischer 2024-05-27 07:05:34 UTC
Hm, I think we never ran into this as we use a temporary patron category for the self registration instead of a regular one, which also enables to delete accounts that don't finish registration in the library after a while.

But for libraries using a different workflow that seems to make sense.