Bug 37692 - Self-registration verification cannot be done if OPACPublic is not allowed
Summary: Self-registration verification cannot be done if OPACPublic is not allowed
Status: Needs Signoff
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: 24.05
Hardware: All All
: P5 - low enhancement
Assignee: Olli-Antti Kivilahti
QA Contact: Testopia
URL:
Keywords:
Depends on: 35445
Blocks:
  Show dependency treegraph
 
Reported: 2024-08-20 18:11 UTC by Olli-Antti Kivilahti
Modified: 2026-01-14 15:15 UTC (History)
4 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 37692 - Self-registration verification cannot be done if OPACPublic is not allowed (1.77 KB, patch)
2024-08-27 11:05 UTC, Olli-Antti Kivilahti
Details | Diff | Splinter Review
Bug 37692: Self-registration verification cannot be done if OPACPublic is not allowed (2.31 KB, patch)
2026-01-14 15:13 UTC, Lari Taskula
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Olli-Antti Kivilahti 2024-08-20 18:11:29 UTC
User needs to be logged in to verify his pending account creation.
Comment 1 Olli-Antti Kivilahti 2024-08-27 11:05:02 UTC
Created attachment 170761 [details] [review]
Bug 37692 - Self-registration verification cannot be done if OPACPublic is not allowed

Registering new accounts need to be done even though OPAC requires login.
Comment 2 SamSowanick 2024-09-04 19:30:20 UTC
Can you please include a test / sign off plan.

Sam.
Comment 3 David Nind 2024-09-08 21:50:42 UTC
I changed the assignee.
Comment 4 Fiona Borthwick 2024-09-26 18:47:09 UTC
Failing QA due to missing test plan
Comment 5 Olli-Antti Kivilahti 2024-09-27 05:26:38 UTC
Test plan:

1. Set syspref OPACPublic to "not-public"
2. OPAC Self-registration verification link is not accessible for users not-logged-in
Comment 6 Olli-Antti Kivilahti 2024-09-27 06:01:54 UTC
The real question is, is this something that should be done, in this way, from a security-perspective?
Obviously something needs to be done since the OPACSelfRegistration-feature doesnt work without this.
Comment 7 Lari Taskula 2026-01-14 14:19:41 UTC
(In reply to Olli-Antti Kivilahti from comment #6)
> The real question is, is this something that should be done, in this way,
> from a security-perspective?
> Obviously something needs to be done since the OPACSelfRegistration-feature
> doesnt work without this.

Based on this comment, setting status to In Discussion.
Comment 8 Lari Taskula 2026-01-14 14:48:12 UTC
To reproduce:
Set the following system preferences
-1. Set PatronSelfRegistration to 'Allow'
-2. Set PatronSelfRegistrationVerifyByEmail to 'Require'
-3. Set OpacPublic to 'Disable'

1. Navigate to OPAC
2. Observe login screen is presented
3. Observe "Create an account" is present
4. Click "Create an account"
5. Fill in mandatory fields
6. Click "Submit" button
7. Grab your verification token from the database by using the following query:
SELECT verification_token FROM borrower_modifications;
8. Go to /cgi-bin/koha/opac-registration-verify.pl?token=XXX where XXX is the verification_token
9. Observe login screen is presented and self-registration verification is still pending

The last step should instead be:

9. Observe "Registration pending", "Click the button below to confirm registration."
10. Click "Confirm" button
11. Observe "Registration complete!", "You have successfully registered your new account."
Comment 9 Lari Taskula 2026-01-14 15:09:20 UTC
(In reply to Olli-Antti Kivilahti from comment #6)
> The real question is, is this something that should be done, in this way,
> from a security-perspective?
> Obviously something needs to be done since the OPACSelfRegistration-feature
> doesnt work without this.

This page is protected by system preference "PatronSelfRegistration". In case it is disabled, the user is redirected to opac-main and from there to the login screen.

The user is also redirected to the login screen if they present an invalid verification token. So a valid verification token is needed in order to temporarily bypass a disabled OpacPublic setting.

Additionally, C4::Auth::checkauth has in the past accepted bypassing OpacPublic for this particular view. See https://github.com/Koha-Community/Koha/blob/6744b12d3ab4d9e33b22076c0e43b32070efa20c/C4/Auth.pm#L835

So I think your patch is okay.
Comment 10 Lari Taskula 2026-01-14 15:13:44 UTC
Created attachment 191422 [details] [review]
Bug 37692: Self-registration verification cannot be done if OPACPublic is not allowed

Registering new accounts need to be done even though OPAC requires login.
To test:
Set the following system preferences
-1. Set PatronSelfRegistration to 'Allow'
-2. Set PatronSelfRegistrationVerifyByEmail to 'Require'
-3. Set OpacPublic to 'Disable'

Before applying the patch,
1. Navigate to OPAC
2. Observe login screen is presented
3. Observe "Create an account" is present
4. Click "Create an account"
5. Fill in mandatory fields
6. Click "Submit" button
7. Grab your verification token from the database by using the following query:
SELECT verification_token FROM borrower_modifications;
8. Go to /cgi-bin/koha/opac-registration-verify.pl?token=XXX where XXX is the verification_token
9. Observe login screen is presented and self-registration verification is still pending

After applying the patch, the last step should be:
9. Observe "Registration pending", "Click the button below to confirm registration."
10. Click "Confirm" button
11. Observe "Registration complete!", "You have successfully registered your new account."
Comment 11 Lari Taskula 2026-01-14 15:15:35 UTC
Comment on attachment 170761 [details] [review]
Bug 37692 - Self-registration verification cannot be done if OPACPublic is not allowed

Review of attachment 170761 [details] [review]:
-----------------------------------------------------------------

I have tidied the patch, fixed the commit message, added a test plan, and removed the last authnotrequired as your change had no effect on it.

::: opac/opac-registration-verify.pl
@@ +173,4 @@
>          template_name   => "opac-registration-invalid.tt",
>          type            => "opac",
>          query           => $cgi,
> +        authnotrequired => 1,

This last authnotrequired has no effect no matter the setting. The user will always be redirected to the login screen.