Bug 24327 - Anonymous suggestions should not be allowed if AnonymousPatron misconfigured
Summary: Anonymous suggestions should not be allowed if AnonymousPatron misconfigured
Status: Pushed to stable
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-01-02 10:37 UTC by Jonathan Druart
Modified: 2020-01-31 20:46 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:
20.05.00, 19.11.02


Attachments
Bug 24327: Add warning to the about page is AnonSugggestions but AnonymousPatron (8.29 KB, patch)
2020-01-02 10:43 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 24327: Redirect to the login form if AnonSuggestion misconfigured (1.27 KB, patch)
2020-01-02 10:43 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 24327: Add warning to the about page is AnonSugggestions but AnonymousPatron (8.32 KB, patch)
2020-01-02 14:20 UTC, ByWater Sandboxes
Details | Diff | Splinter Review
Bug 24327: Redirect to the login form if AnonSuggestion misconfigured (1.31 KB, patch)
2020-01-02 14:20 UTC, ByWater Sandboxes
Details | Diff | Splinter Review
Bug 24327: Add warning to the about page is AnonSugggestions but AnonymousPatron (8.38 KB, patch)
2020-01-02 22:01 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 24327: Redirect to the login form if AnonSuggestion misconfigured (1.37 KB, patch)
2020-01-02 22:01 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2020-01-02 10:37:32 UTC
If anonymous suggestions (AnonSuggestions) are allowed but AnonymousPatron is not set correctly, it's possible to create a suggestion without being logged in and the app explodes with a FK constraint:

DBD::mysql::st execute failed: Cannot add or update a child row: a foreign key constraint fails (`koha_kohadev`.`suggestions`, CONSTRAINT `suggestions_ibfk_suggestedby` FOREIGN KEY (`suggestedby`) REFERENCES `bo
rrowers` (`borrowernumber`) ON DELETE SET NULL ON UPDATE CASCADE) [for Statement "INSERT INTO `suggestions` ( `STATUS`, `author`, `branchcode`, `collectiontitle`, `copyrightdate`, `isbn`, `itemtype`, `note`, `pa
tronreason`, `place`, `publishercode`, `quantity`, `suggestedby`, `suggesteddate`, `title`) VALUES ( ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? )" with ParamValues: 0="ASKED", 1="", 2=undef, 3="", 4=undef, 5=""
, 6="AUDIOBOOK", 7="", 8="", 9="", 10="", 11=undef, 12="0", 13='2020-01-02T10:28:40', 14="xxx"] at /usr/share/perl5/DBIx/Class/Storage/DBI.pm line 1836.               
Broken FK constraint at /usr/share/perl5/Exception/Class/Base.pm line 88                                                      
        Exception::Class::Base::throw('Koha::Exceptions::Object::FKConstraint', 'error', 'Broken FK constraint', 'broken_fk', 'suggestedby') called at /kohadevbox/koha/Koha/Object.pm line 164
Comment 1 Jonathan Druart 2020-01-02 10:43:28 UTC
Created attachment 96730 [details] [review]
Bug 24327: Add warning to the about page is AnonSugggestions but AnonymousPatron

This patch adds a warning to the about page if AnonSuggestions is set
but AnonymousPatron.

Test plan:
Turn on AnonSuggestions and set AnonymousPatron to 0
=> You see a warning on the about page
Turn on AnonSuggestions and set AnonymousPatron to an invalid value
=> You see a warning on the about page
Turn off AnonSuggestions
=> No warning
Turn on AnonSuggestions and set AnonymousPatron to a valid value
=> No warning
Comment 2 Jonathan Druart 2020-01-02 10:43:31 UTC
Created attachment 96731 [details] [review]
Bug 24327: Redirect to the login form if AnonSuggestion misconfigured

Test plan:
Turn on AnonSuggestion but set AnonymousPatron to an invalid value
Go to /cgi-bin/koha/opac-suggestions.pl?op=add
=> You see the login form
Comment 3 ByWater Sandboxes 2020-01-02 14:20:03 UTC
Created attachment 96746 [details] [review]
Bug 24327: Add warning to the about page is AnonSugggestions but AnonymousPatron

This patch adds a warning to the about page if AnonSuggestions is set
but AnonymousPatron.

Test plan:
Turn on AnonSuggestions and set AnonymousPatron to 0
=> You see a warning on the about page
Turn on AnonSuggestions and set AnonymousPatron to an invalid value
=> You see a warning on the about page
Turn off AnonSuggestions
=> No warning
Turn on AnonSuggestions and set AnonymousPatron to a valid value
=> No warning

Signed-off-by: hc <hc@interleaf.ie>
Comment 4 ByWater Sandboxes 2020-01-02 14:20:05 UTC
Created attachment 96747 [details] [review]
Bug 24327: Redirect to the login form if AnonSuggestion misconfigured

Test plan:
Turn on AnonSuggestion but set AnonymousPatron to an invalid value
Go to /cgi-bin/koha/opac-suggestions.pl?op=add
=> You see the login form

Signed-off-by: hc <hc@interleaf.ie>
Comment 5 Holly 2020-01-02 14:20:58 UTC
Both test plans were successful.
Comment 6 Katrin Fischer 2020-01-02 22:01:14 UTC
Created attachment 96772 [details] [review]
Bug 24327: Add warning to the about page is AnonSugggestions but AnonymousPatron

This patch adds a warning to the about page if AnonSuggestions is set
but AnonymousPatron.

Test plan:
Turn on AnonSuggestions and set AnonymousPatron to 0
=> You see a warning on the about page
Turn on AnonSuggestions and set AnonymousPatron to an invalid value
=> You see a warning on the about page
Turn off AnonSuggestions
=> No warning
Turn on AnonSuggestions and set AnonymousPatron to a valid value
=> No warning

Signed-off-by: hc <hc@interleaf.ie>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 7 Katrin Fischer 2020-01-02 22:01:18 UTC
Created attachment 96773 [details] [review]
Bug 24327: Redirect to the login form if AnonSuggestion misconfigured

Test plan:
Turn on AnonSuggestion but set AnonymousPatron to an invalid value
Go to /cgi-bin/koha/opac-suggestions.pl?op=add
=> You see the login form

Signed-off-by: hc <hc@interleaf.ie>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 8 Katrin Fischer 2020-01-02 22:02:13 UTC
Hi Holly,

at the moment your sign off line shows "hc" as the name, which will turn up in the Release notes - would you like us to change it so it shows your full name instead?

Signed-off-by: hc <hc@interleaf.ie>
Comment 9 Holly 2020-01-03 13:01:18 UTC
Hi Katrin,
That would be great. I'll sign in full in the future, hc is just a habit. 
Thanks,
Holly
Comment 10 Martin Renvoize 2020-01-08 14:25:56 UTC
Nice work everyone!

Pushed to master for 20.05
Comment 11 Joy Nelson 2020-01-14 01:22:24 UTC
Pushed to 19.11.x branch for 19.11.02
Comment 12 Lucas Gass 2020-01-31 20:46:06 UTC
cant clean apply this patchset to the 19.05.x branch, if needed please rebase