This script certainly needs a better authentication check but it is less trivial than the others. The block with Koha::Ratings calls should be within a check on loggedinuser. The whole script is a weird mix between an ajax script and a regular one. This statement will crash on an undefined borrowernumber (SQL constraint): Koha::Rating->new( { biblionumber => $biblionumber, borrowernumber => $loggedinuser, rating_value => $rating_value, })->store;
Do we know if this feature is even used ? Looks like a very old pre-social-network feature. In HEA we see preference is enabled, but it is by default.
If I am correct that these are the star ratings, there has been additions in the last versions to it which I think shows it must be used.
Created attachment 139171 [details] [review] Bug 29939: Use the REST API for ratings This patch replaces opac-ratings-ajax.pl with a new REST API route POST /public/biblios/42/ratings Note that we could go further and refactor the 'start_rating' select code. Test plan: Test the "star ratings" feature at the OPAC, on the different page where it's displayed.
Stealing this bug, but you may consider it needs its own bug. Let me know and I will move the patch somewhere else.
Created attachment 139412 [details] [review] Bug 29939: Use the REST API for ratings This patch replaces opac-ratings-ajax.pl with a new REST API route POST /public/biblios/42/ratings Note that we could go further and refactor the 'start_rating' select code. Test plan: Test the "star ratings" feature at the OPAC, on the different page where it's displayed. Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Created attachment 139559 [details] [review] Bug 29939: Use the REST API for ratings This patch replaces opac-ratings-ajax.pl with a new REST API route POST /public/biblios/42/ratings Note that we could go further and refactor the 'start_rating' select code. Test plan: Test the "star ratings" feature at the OPAC, on the different page where it's displayed. Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Pushed to master for 22.11. Nice work everyone, thanks!
Enhancement will not be in 22.05.x