Bug 36570 - OAI-PMH - Hide items non-public notes
Summary: OAI-PMH - Hide items non-public notes
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Web services (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-10 20:07 UTC by Pablo AB
Modified: 2024-04-11 00:56 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Pablo AB 2024-04-10 20:07:23 UTC
After enabling the expose of items (`include_items: 1` on `OAI-PMH:ConfFile`) the info of 952$x Non-public note (items.itemnotes_nonpublic) is shown, potentially exposing sensitive information.

Not sure how a solution to this issue may interact with OpacHiddenItems.
Comment 1 David Cook 2024-04-11 00:04:47 UTC
I noticed this a few months ago as well. Basically, the OAI-PMH isn't respecting the bibliographic frameworks in general, so other hidden fields would also be shown. 

This does need a fix...
Comment 2 Pablo AB 2024-04-11 00:40:42 UTC
Right! Likewise, I notice data leakage (particularly through 9xx) while using marcxml, since Bug 19353 is relatively recent. Maybe a new syspref could define if the subfield OAI visibility state should honor the OPAC visibility flag (before passing through the XSLT (i.e., any metadataPrefix)). Usually, if the subfield should not be seen by humans, should not be seen by machines also. Could be OAI-PMH:HonorOPACVisibilityFlag.

Or maybe rename the ancient visibility flag "Flagged" to "OAI" (no one knows its purpose, Bug 14772).
Comment 3 David Cook 2024-04-11 00:56:51 UTC
I've also been wondering about adding a system preference like that. 

I suppose another option would be in the OAI config file. For instance, defaulting to honouring the OPAC visibility with an ability to override it on a per metadata format basis. 

That might actually be the best way to do it.