Bug 13917 - OPAC: Placing holds still possible by URL even if turned off by system preference
Summary: OPAC: Placing holds still possible by URL even if turned off by system prefer...
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Hold requests (show other bugs)
Version: master
Hardware: All All
: P5 - low major (vote)
Assignee: Marc Véron
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-03-26 13:46 UTC by Marc Véron
Modified: 2015-12-03 22:02 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
OPAC: Putting holds still possible by URL even if turned off by system preference (1.50 KB, patch)
2015-03-26 14:15 UTC, Marc Véron
Details | Diff | Splinter Review
Bug 13917: OPAC: Putting holds still possible by URL even if turned off by system preference (1.52 KB, patch)
2015-04-13 09:50 UTC, Jonathan Druart
Details | Diff | Splinter Review
[PASSED QA] Bug 13917: OPAC: Putting holds still possible by URL even if turned off by system preference (1.58 KB, patch)
2015-04-15 20:25 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Marc Véron 2015-03-26 13:46:27 UTC
To reproduce:

1)
In staff client, set System preference 'RequestOnOpac' to 'Allow patrons to place holds on items from the OPAC.'
2)
Log in to OPAC with a patron' credentials, search a record, place hold without confirming, copy URL, something like 
[YOUR SERVER]/cgi-bin/koha/opac-reserve.pl?biblionumbers=1
3)
In staff client, set  System preference 'RequestOnOpac' to 'Don't allow patrons to place holds on items from the OPAC.'
4)
Log out. Log in again in OPAC.
5)
Paste URL in browser's address bar

Result: Page displays, you can put a hold on the requested item.

Expected: 
404 page, similar to solution for Bug 12703
Comment 1 Marc Véron 2015-03-26 14:15:24 UTC Comment hidden (obsolete)
Comment 2 Marc Véron 2015-04-12 18:18:25 UTC
Re-tested, still applies.
Comment 3 Jonathan Druart 2015-04-13 09:50:57 UTC Comment hidden (obsolete)
Comment 4 Jonathan Druart 2015-04-13 09:51:28 UTC
Hum, I would raise the severity to major for this one.
Comment 5 Katrin Fischer 2015-04-15 20:25:19 UTC
Created attachment 37917 [details] [review]
[PASSED QA] Bug 13917: OPAC: Putting holds still possible by URL even if turned off by system preference

To test:

1)
Prepare an URL that put's a hold in OPAC (see comment #1), e.g.
[YOUR SERVER]/cgi-bin/koha/opac-reserve.pl?biblionumbers=1

2)
Set system preference 'RequestOnOpac' to 'Don't allow patrons to place holds on items from the OPAC.'

3)
Go diectly to this URL.
Result: The page displays to confirm hold (wrong)

4)
Apply patch

5)
Repeat step 3
Result: Redirect to 404 page (OK)

6)
Set system preference to "Allow"

7)
Repeat step 3
Result: The page displays to confirm hold (OK), like it would be from link in OPAC.

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 6 Katrin Fischer 2015-04-15 20:26:22 UTC
I think if we look really close... we'd find more features that need this kind of fix - thx for the patch!
Comment 7 Tomás Cohen Arazi 2015-04-20 13:32:02 UTC
Patch pushed to master.

Nice catch Marc!
Comment 8 Chris Cormack 2015-04-22 05:44:31 UTC
Pushed to 3.18.x will be in 3.18.6