Bug 23774 - When placing a hold editing using Inspect Element allows addition to the code of non listed library
Summary: When placing a hold editing using Inspect Element allows addition to the code...
Status: Pushed to stable
Alias: None
Product: Koha
Classification: Unclassified
Component: Circulation (show other bugs)
Version: master
Hardware: All All
: P5 - low major (vote)
Assignee: Lari Taskula
QA Contact: Jonathan Druart
URL:
Keywords:
Depends on: 7614
Blocks:
  Show dependency treegraph
 
Reported: 2019-10-08 11:39 UTC by Patrick
Modified: 2019-11-15 10:03 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:
19.11.00,19.05.05


Attachments
Bug 23774: Server-side confirmation for hold pickup location in OPAC (2.06 KB, patch)
2019-11-04 16:42 UTC, Lari Taskula
Details | Diff | Splinter Review
Bug 23774: Server-side confirmation for hold pickup location in OPAC (2.12 KB, patch)
2019-11-04 17:15 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 23774: Server-side confirmation for hold pickup location in OPAC (2.20 KB, patch)
2019-11-05 09:06 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Patrick 2019-10-08 11:39:28 UTC
While placing a hold on a book, if a user opens up Inspect Element on the Pick up location drop down box they can change the pick up location in the code to a library that is not listed as a pick up location.

How to replicate:
Search for a book
Select book
Click Place Hold

On the screen Home > Placing a hold

Right click on Pick up location
Select 'Inspect Element'

Under 
<!-- HOLDABLE -->

<li class="Branch">
<select name="Branch ******"> Pick Up location:</label>=$0

Option values are listed that relate to the pick up location, this value can be changed to another new location and when the hold is placed the hold will be placed for this new location instead of the listed options in the Pick up location drop down list.
Comment 1 Katrin Fischer 2019-10-11 05:53:18 UTC
Hi Patrick,
which preferences/features do you use to limit the list of pick-up locations in the first place? I'd like to confirm the bug, but need more information about your configuration.
Comment 2 Patrick 2019-10-11 13:54:48 UTC
Hi Katrin,

The list is built based on the "Pickup Location" flag on the branches record being set to "Yes"

Kind regards,

Patrick
Comment 3 Lari Taskula 2019-11-04 16:42:18 UTC
Created attachment 95018 [details] [review]
Bug 23774: Server-side confirmation for hold pickup location in OPAC

While placing a hold on a book, if a user opens up Inspect Element on the
Pick up location drop down box they can change the pick up location in
the code to a library that is not listed as a pick up location.

How to replicate:
Search for a book
Select book
Click Place Hold

On the screen Home > Placing a hold

Right click on Pick up location
Select 'Inspect Element'

Under
<!-- HOLDABLE -->

<li class="Branch">
<select name="Branch ******"> Pick Up location:</label>=$0

Option values are listed that relate to the pick up location, this value
can be changed to another new location and when the hold is placed
the hold will be placed for this new location instead of the listed options
in the Pick up location drop down list.

To test:
1. Apply patch
2. Repeat "How to replicate"
3. Observe it is no longer possible to place holds on libraries not defined
   as pickup location by changing option value via Inspect Element tool
Comment 4 Martin Renvoize 2019-11-04 17:15:14 UTC
Created attachment 95023 [details] [review]
Bug 23774: Server-side confirmation for hold pickup location in OPAC

While placing a hold on a book, if a user opens up Inspect Element on the
Pick up location drop down box they can change the pick up location in
the code to a library that is not listed as a pick up location.

How to replicate:
Search for a book
Select book
Click Place Hold

On the screen Home > Placing a hold

Right click on Pick up location
Select 'Inspect Element'

Under
<!-- HOLDABLE -->

<li class="Branch">
<select name="Branch ******"> Pick Up location:</label>=$0

Option values are listed that relate to the pick up location, this value
can be changed to another new location and when the hold is placed
the hold will be placed for this new location instead of the listed options
in the Pick up location drop down list.

To test:
1. Apply patch
2. Repeat "How to replicate"
3. Observe it is no longer possible to place holds on libraries not defined
   as pickup location by changing option value via Inspect Element tool

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 5 Martin Renvoize 2019-11-04 17:16:13 UTC
Thanks for the quick fix once assigned Lari, I'd meant to catch you to ask but you beat me to it :).

Works as requested, so glad you jumped in as I was somewhat daunted when I started digging through the code.

Signing Off.
Comment 6 Patrick 2019-11-04 17:21:51 UTC
Many thanks Lari, Martin & Kathrin.
Greatly appreciated.
Kind regards,
Patrick.
Comment 7 Jonathan Druart 2019-11-05 09:06:46 UTC
Created attachment 95041 [details] [review]
Bug 23774: Server-side confirmation for hold pickup location in OPAC

While placing a hold on a book, if a user opens up Inspect Element on the
Pick up location drop down box they can change the pick up location in
the code to a library that is not listed as a pick up location.

How to replicate:
Search for a book
Select book
Click Place Hold

On the screen Home > Placing a hold

Right click on Pick up location
Select 'Inspect Element'

Under
<!-- HOLDABLE -->

<li class="Branch">
<select name="Branch ******"> Pick Up location:</label>=$0

Option values are listed that relate to the pick up location, this value
can be changed to another new location and when the hold is placed
the hold will be placed for this new location instead of the listed options
in the Pick up location drop down list.

To test:
1. Apply patch
2. Repeat "How to replicate"
3. Observe it is no longer possible to place holds on libraries not defined
   as pickup location by changing option value via Inspect Element tool

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 8 Martin Renvoize 2019-11-06 17:10:29 UTC
Nice work!

Pushed to master for 19.11.00
Comment 9 Fridolin SOMERS 2019-11-15 10:03:59 UTC
Pushed to 19.05.x for 19.05.05