User needs to be logged in to verify his pending account creation.
Created attachment 170761 [details] [review] Bug 37692 - Self-registration verification cannot be done if OPACPublic is not allowed Registering new accounts need to be done even though OPAC requires login.
Can you please include a test / sign off plan. Sam.
I changed the assignee.
Failing QA due to missing test plan
Test plan: 1. Set syspref OPACPublic to "not-public" 2. OPAC Self-registration verification link is not accessible for users not-logged-in
The real question is, is this something that should be done, in this way, from a security-perspective? Obviously something needs to be done since the OPACSelfRegistration-feature doesnt work without this.
(In reply to Olli-Antti Kivilahti from comment #6) > The real question is, is this something that should be done, in this way, > from a security-perspective? > Obviously something needs to be done since the OPACSelfRegistration-feature > doesnt work without this. Based on this comment, setting status to In Discussion.
To reproduce: Set the following system preferences -1. Set PatronSelfRegistration to 'Allow' -2. Set PatronSelfRegistrationVerifyByEmail to 'Require' -3. Set OpacPublic to 'Disable' 1. Navigate to OPAC 2. Observe login screen is presented 3. Observe "Create an account" is present 4. Click "Create an account" 5. Fill in mandatory fields 6. Click "Submit" button 7. Grab your verification token from the database by using the following query: SELECT verification_token FROM borrower_modifications; 8. Go to /cgi-bin/koha/opac-registration-verify.pl?token=XXX where XXX is the verification_token 9. Observe login screen is presented and self-registration verification is still pending The last step should instead be: 9. Observe "Registration pending", "Click the button below to confirm registration." 10. Click "Confirm" button 11. Observe "Registration complete!", "You have successfully registered your new account."
(In reply to Olli-Antti Kivilahti from comment #6) > The real question is, is this something that should be done, in this way, > from a security-perspective? > Obviously something needs to be done since the OPACSelfRegistration-feature > doesnt work without this. This page is protected by system preference "PatronSelfRegistration". In case it is disabled, the user is redirected to opac-main and from there to the login screen. The user is also redirected to the login screen if they present an invalid verification token. So a valid verification token is needed in order to temporarily bypass a disabled OpacPublic setting. Additionally, C4::Auth::checkauth has in the past accepted bypassing OpacPublic for this particular view. See https://github.com/Koha-Community/Koha/blob/6744b12d3ab4d9e33b22076c0e43b32070efa20c/C4/Auth.pm#L835 So I think your patch is okay.
Created attachment 191422 [details] [review] Bug 37692: Self-registration verification cannot be done if OPACPublic is not allowed Registering new accounts need to be done even though OPAC requires login. To test: Set the following system preferences -1. Set PatronSelfRegistration to 'Allow' -2. Set PatronSelfRegistrationVerifyByEmail to 'Require' -3. Set OpacPublic to 'Disable' Before applying the patch, 1. Navigate to OPAC 2. Observe login screen is presented 3. Observe "Create an account" is present 4. Click "Create an account" 5. Fill in mandatory fields 6. Click "Submit" button 7. Grab your verification token from the database by using the following query: SELECT verification_token FROM borrower_modifications; 8. Go to /cgi-bin/koha/opac-registration-verify.pl?token=XXX where XXX is the verification_token 9. Observe login screen is presented and self-registration verification is still pending After applying the patch, the last step should be: 9. Observe "Registration pending", "Click the button below to confirm registration." 10. Click "Confirm" button 11. Observe "Registration complete!", "You have successfully registered your new account."
Comment on attachment 170761 [details] [review] Bug 37692 - Self-registration verification cannot be done if OPACPublic is not allowed Review of attachment 170761 [details] [review]: ----------------------------------------------------------------- I have tidied the patch, fixed the commit message, added a test plan, and removed the last authnotrequired as your change had no effect on it. ::: opac/opac-registration-verify.pl @@ +173,4 @@ > template_name => "opac-registration-invalid.tt", > type => "opac", > query => $cgi, > + authnotrequired => 1, This last authnotrequired has no effect no matter the setting. The user will always be redirected to the login screen.