| Summary: | Public Biblio endpoint should honour OpacSuppression syspref | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Martin Renvoize (ashimema) <martin.renvoize> |
| Component: | REST API | Assignee: | Martin Renvoize (ashimema) <martin.renvoize> |
| Status: | Pushed to main --- | QA Contact: | Marcel de Rooy <m.de.rooy> |
| Severity: | major | ||
| Priority: | P5 - low | CC: | dcook, m.de.rooy, tomascohen |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Crowdfunding goal: | 0 |
| Patch complexity: | Small patch | Documentation contact: | |
| Documentation submission: | Text to go in the release notes: | ||
| Version(s) released in: |
25.11.00
|
Circulation function: | |
| Bug Depends on: | 38330 | ||
| Bug Blocks: | |||
| Attachments: |
Bug 39336: Public Biblio endpoint should honour OpacSuppression syspref
Bug 39336: Public Biblio endpoint should honour OpacSuppression syspref Bug 39336: Public Biblio endpoint should honour OpacSuppression syspref |
||
|
Description
Martin Renvoize (ashimema)
2025-03-14 16:03:15 UTC
Created attachment 187665 [details] [review] Bug 39336: Public Biblio endpoint should honour OpacSuppression syspref This patch makes the Public Biblio endpoint respect the OpacSuppression system preference and the biblio.opac_suppressed field introduced in Bug 38330. When OpacSuppression is enabled and a biblio has opac_suppressed set to 1, the endpoint now returns a 404 (Not Found) response instead of exposing the bibliographic record. Test plan: 1. Apply patch 2. Run: prove t/db_dependent/api/v1/biblios.t 3. Verify all tests pass, including the new OpacSuppression subtest 4. Test manually: - Enable OpacSuppression syspref - Set a biblio's opac_suppressed field to 1 - Access /api/v1/public/biblios/{biblio_id} - Confirm it returns 404 - Set opac_suppressed to 0 - Confirm it returns 200 with the record - Disable OpacSuppression syspref - Confirm record is visible regardless of opac_suppressed value Created attachment 188183 [details] [review] Bug 39336: Public Biblio endpoint should honour OpacSuppression syspref This patch makes the Public Biblio endpoint respect the OpacSuppression system preference and the biblio.opac_suppressed field introduced in Bug 38330. When OpacSuppression is enabled and a biblio has opac_suppressed set to 1, the endpoint now returns a 404 (Not Found) response instead of exposing the bibliographic record. Test plan: 1. Apply patch 2. Run: prove t/db_dependent/api/v1/biblios.t 3. Verify all tests pass, including the new OpacSuppression subtest 4. Test manually: - Enable OpacSuppression syspref - Set a biblio's opac_suppressed field to 1 - Access /api/v1/public/biblios/{biblio_id} - Confirm it returns 404 - Set opac_suppressed to 0 - Confirm it returns 200 with the record - Disable OpacSuppression syspref - Confirm record is visible regardless of opac_suppressed value Signed-off-by: David Cook <dcook@prosentient.com.au> Created attachment 188401 [details] [review] Bug 39336: Public Biblio endpoint should honour OpacSuppression syspref This patch makes the Public Biblio endpoint respect the OpacSuppression system preference and the biblio.opac_suppressed field introduced in Bug 38330. When OpacSuppression is enabled and a biblio has opac_suppressed set to 1, the endpoint now returns a 404 (Not Found) response instead of exposing the bibliographic record. Test plan: 1. Apply patch 2. Run: prove t/db_dependent/api/v1/biblios.t 3. Verify all tests pass, including the new OpacSuppression subtest 4. Test manually: - Enable OpacSuppression syspref - Set a biblio's opac_suppressed field to 1 - Access /api/v1/public/biblios/{biblio_id} - Confirm it returns 404 - Set opac_suppressed to 0 - Confirm it returns 200 with the record - Disable OpacSuppression syspref - Confirm record is visible regardless of opac_suppressed value Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Not sure about major here btw Nice work everyone! Pushed to main for 25.11 (In reply to Marcel de Rooy from comment #4) > Not sure about major here btw I think it's probably valid. One could argue that this is actually a security bug, because it involves information disclosure. Some libraries have private information in records that should never be public. I've even heard of libraries that rely on OpacSuppression to protect them from being censured by authorities. For most libraries, it's probably minor, but it could be major for some I'd say. Major is certainly correct here. Do we need to check other routes as well? Items with OpacHiddenItems? (In reply to Katrin Fischer from comment #7) > Major is certainly correct here. > > Do we need to check other routes as well? Items with OpacHiddenItems? Yeah, that would be a good idea to check. (In reply to David Cook from comment #8) > (In reply to Katrin Fischer from comment #7) > > Major is certainly correct here. > > > > Do we need to check other routes as well? Items with OpacHiddenItems? > > Yeah, that would be a good idea to check. Yeah, it already handles OpacHiddenItems a few lines lower on Koha/REST/V1/Biblios.pm so all good there. |