Summary: | It's possible to view lists/virtualshelves even when virtualshelves is off | ||
---|---|---|---|
Product: | Koha | Reporter: | Magnus Enger <magnus> |
Component: | Lists | Assignee: | Owen Leonard <oleonard> |
Status: | CLOSED FIXED | QA Contact: | Bugs List <koha-bugs> |
Severity: | normal | ||
Priority: | P5 - low | CC: | aleisha, brendan, dcook, f.demians, jonathan.druart, julian.maurice, kyle, m.de.rooy |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Small patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Attachments: |
Bug 6322 - It's possible to view lists/virtualshelves even when virtualshelves is off
Bug 6322 - It's possible to view lists/virtualshelves even when virtualshelves is off Bug 6322 - It's possible to view lists/virtualshelves even when virtualshelves is off Bug 6322 - It's possible to view lists/virtualshelves even when virtualshelves is off |
Description
Magnus Enger
2011-05-08 20:24:05 UTC
This bug is still valid in master as of 3.12 beta1. Created attachment 27502 [details] [review] Bug 6322 - It's possible to view lists/virtualshelves even when virtualshelves is off If the user knows the URL for OPAC lists they can access them even with the virtualshelves preference turned off. This patch copies the solution added to opac-topissues.pl by Bug 10595 and applies it to OPAC lists pages. To test, apply the patch and set the virtualshelves system preference to "don't allow." - Navigate to /cgi-bin/koha/opac-shelves.pl. You should be redirected to an Error 404 page. - Also check /cgi-bin/koha/opac-shareshelf.pl. - Turn virtualshelves back on. Access to lists and list sharing should be restored. I quite like this idea (and this patch works well), but it should probably also include the following pages: opac-downloadshelf.pl opac-sendshelf.pl opac-addbybiblionumber.pl There might be others, but those are the ones that I've noticed. Just marking this as failed, as it's not quite inclusive enough yet. Created attachment 29611 [details] [review] Bug 6322 - It's possible to view lists/virtualshelves even when virtualshelves is off If the user knows the URL for OPAC lists they can access them even with the virtualshelves preference turned off. This patch copies the solution added to opac-topissues.pl by Bug 10595 and applies it to OPAC lists pages. To test, apply the patch and set the virtualshelves system preference to "don't allow." - Navigate to /cgi-bin/koha/opac-shelves.pl. You should be redirected to an Error 404 page. - Also check: - /cgi-bin/koha/opac-shareshelf.pl. - /cgi-bin/koha/opac-downloadshelf.pl - /cgi-bin/koha/opac-sendshelf.pl - /cgi-bin/koha/opac-addbybiblionumber.pl - Turn virtualshelves back on. Access to lists and list sharing should be restored. I wasn't able to recreate the bug as all pages mentioned redirected to Error 404 pages with the virtualshelves syspref set to 'Don't allow' (as it should) but also when set to 'Allow' (as it shouldn't). However I don't think the patch was breaking anything. Setting to Failed QA because I was unable to recreate the bug and test the patch. Created attachment 46563 [details] [review] Bug 6322 - It's possible to view lists/virtualshelves even when virtualshelves is off If the user knows the URL for OPAC lists they can access them even with the virtualshelves preference turned off. This patch copies the solution added to opac-topissues.pl by Bug 10595 and applies it to OPAC lists pages. To test, apply the patch and set the virtualshelves system preference to "don't allow." - Navigate to /cgi-bin/koha/opac-shelves.pl. You should be redirected to an Error 404 page. - Also check: - /cgi-bin/koha/opac-shareshelf.pl. - /cgi-bin/koha/opac-downloadshelf.pl - /cgi-bin/koha/opac-sendshelf.pl - /cgi-bin/koha/opac-addbybiblionumber.pl - Turn virtualshelves back on. Access to lists and list sharing should be restored. Signed-off-by: Aleisha <aleishaamohia@hotmail.com> There was a merge conflict in opac-addbybiblionumber.pl but I think I fixed it. Not sure what went wrong the first time I tested this but seems fine to sign off now :) Comment on attachment 46563 [details] [review] Bug 6322 - It's possible to view lists/virtualshelves even when virtualshelves is off Review of attachment 46563 [details] [review]: ----------------------------------------------------------------- ::: opac/opac-addbybiblionumber.pl @@ -41,5 @@ > our @biblios; > > - > -if (scalar(@biblionumber) == 1) { > - @biblionumber = (split /\//,$biblionumber[0]); No it has not been fixed correctly, these lines should be kept. Owen, Don't you think we should apply the same fix for the staff interface? Created attachment 46715 [details] [review] Bug 6322 - It's possible to view lists/virtualshelves even when virtualshelves is off If the user knows the URL for OPAC lists they can access them even with the virtualshelves preference turned off. This patch copies the solution added to opac-topissues.pl by Bug 10595 and applies it to OPAC lists pages. To test, apply the patch and set the virtualshelves system preference to "don't allow." - Navigate to /cgi-bin/koha/opac-shelves.pl. You should be redirected to an Error 404 page. - Also check: - /cgi-bin/koha/opac-shareshelf.pl. - /cgi-bin/koha/opac-downloadshelf.pl - /cgi-bin/koha/opac-sendshelf.pl - /cgi-bin/koha/opac-addbybiblionumber.pl - Turn virtualshelves back on. Access to lists and list sharing should be restored. Signed-off-by: Aleisha <aleishaamohia@hotmail.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Aleisha, I'm not sure if you meant to set this to signed off or not. If you did not sign off on this, just set the status to signed-off and I can be the signer. (In reply to Kyle M Hall from comment #12) > Aleisha, I'm not sure if you meant to set this to signed off or not. If you > did not sign off on this, just set the status to signed-off and I can be the > signer. Sorry, yes I was meant to sign off. Not sure why it didn't work (In reply to Aleisha Amohia from comment #13) > (In reply to Kyle M Hall from comment #12) > > Aleisha, I'm not sure if you meant to set this to signed off or not. If you > > did not sign off on this, just set the status to signed-off and I can be the > > signer. > > Sorry, yes I was meant to sign off. Not sure why it didn't work Np! I already added your sign-off to the patch, assuming that was the case. Pushed to Master - Should be in the May 2016 release. Thanks! Patch pushed to 3.22.x, will be in 3.22.3 This patch has been pushed to 3.20.x, will be in 3.20.9. |