Bug 39142 - Add debug permission to allow user to toggle JS and CSS customizations on/off
Summary: Add debug permission to allow user to toggle JS and CSS customizations on/off
Status: Passed QA
Alias: None
Product: Koha
Classification: Unclassified
Component: Staff interface (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Imani
QA Contact: Martin Renvoize (ashimema)
URL:
Keywords: release-notes-needed
Depends on: 14004
Blocks:
  Show dependency treegraph
 
Reported: 2025-02-14 15:11 UTC by Andrew Fuerste-Henry
Modified: 2025-09-29 16:35 UTC (History)
9 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 39142 Add debug permission to allow user to toggle JS and CSS customizations on/off (1.95 KB, patch)
2025-02-14 21:04 UTC, Imani
Details | Diff | Splinter Review
Bug 39142: Add debug permission to allow user to toggle JS and CSS customizations on/off (3.91 KB, patch)
2025-02-18 17:26 UTC, Imani
Details | Diff | Splinter Review
Bug 39142 Add debug permission to allow user to toggle JS and CSS customizations on/off (2.01 KB, patch)
2025-02-21 12:00 UTC, OpenFifth Sandboxes
Details | Diff | Splinter Review
Bug 39142: Add debug permission to allow user to toggle JS and CSS customizations on/off (3.97 KB, patch)
2025-02-21 12:00 UTC, OpenFifth Sandboxes
Details | Diff | Splinter Review
Bug 39142 Add debug permission to allow user to toggle JS and CSS customizations on/off (2.01 KB, patch)
2025-06-20 13:13 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review
Bug 39142: Add debug permission to allow user to toggle JS and CSS customizations on/off (3.99 KB, patch)
2025-06-20 13:13 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review
Bug 39142: Add debug permission (2.31 KB, patch)
2025-09-25 10:53 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review
Bug 39142: Add debug permission to allow user to toggle JS and CSS customizations on/off (4.05 KB, patch)
2025-09-25 10:53 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review
Bug 39142: (QA follow-up) Add unit tests for DISABLE_SYSPREF permission checking (6.54 KB, patch)
2025-09-25 10:53 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review
Bug 39142: (QA follow-up) Add permission checking for syspref overrides (2.51 KB, patch)
2025-09-25 10:53 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review
Bug 39142: fixing capitalization as per coding guidelines https://wiki.koha-community.org/wiki/Coding_Guidelines#HTML4:_Upper_and_lower_cases_in_strings (2.41 KB, patch)
2025-09-29 16:26 UTC, Imani
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Andrew Fuerste-Henry 2025-02-14 15:11:47 UTC
We all love bug 14004 and its fun tools for loading pages without JS or CSS from sysprefs. We'd like to extend that idea to toggles that would appear on every page to turn UserJS and UserCSS on and off. We'd tie those toggles to a new "debug" permission, so only users with that permission will be shown those toggles.
Comment 1 Imani 2025-02-14 21:04:58 UTC
Created attachment 178123 [details] [review]
Bug 39142 Add debug permission to allow user to toggle JS and CSS customizations on/off

Database changes for 39142
Comment 2 Imani 2025-02-18 17:26:18 UTC
Created attachment 178294 [details] [review]
Bug 39142: Add debug permission to allow user to toggle JS and CSS customizations on/off

to test:
1. apply the patch
2. use updatedatabase run to update your db
3. add custom JS and CSS in the IntranetUserJS and IntranetUserCSS fields
4. with as SuperLibrarian account confirm you have 3 buttons at the bottom of
    your screen, Disable User JS, Disable User CSS, and load only default
    stylesheets
5. clicking the buttons should reload the current page with a query to
    disable those things.
6. Log in as a user that is not a superlibrarian and does not have the
    debug UI permission enabled
7. confirm the buttons are no longer visible
8. Add the debug UI permission to the user
9. confirm the debug buttons are now visible for that user.
Comment 3 OpenFifth Sandboxes 2025-02-21 12:00:05 UTC
Created attachment 178481 [details] [review]
Bug 39142 Add debug permission to allow user to toggle JS and CSS customizations on/off

Database changes for 39142

Signed-off-by: Lari Strand <lari.strand@koha-suomi.fi>
Comment 4 OpenFifth Sandboxes 2025-02-21 12:00:07 UTC
Created attachment 178482 [details] [review]
Bug 39142: Add debug permission to allow user to toggle JS and CSS customizations on/off

to test:
1. apply the patch
2. use updatedatabase run to update your db
3. add custom JS and CSS in the IntranetUserJS and IntranetUserCSS fields
4. with as SuperLibrarian account confirm you have 3 buttons at the bottom of
    your screen, Disable User JS, Disable User CSS, and load only default
    stylesheets
5. clicking the buttons should reload the current page with a query to
    disable those things.
6. Log in as a user that is not a superlibrarian and does not have the
    debug UI permission enabled
7. confirm the buttons are no longer visible
8. Add the debug UI permission to the user
9. confirm the debug buttons are now visible for that user.

Signed-off-by: Lari Strand <lari.strand@koha-suomi.fi>
Comment 5 Lari Strand 2025-02-21 12:03:45 UTC
Just a thought, we use multiple Koha plugins that inject Javascript or CSS to the intranet views (subs intranet_js/css in plugin main modules). The plugins can always be disabled but maybe it should be considered as an option in this new feature?
Comment 6 Imani 2025-02-21 16:01:32 UTC
A possible future enhancement to enable that maybe setting up a plugin hook for plugins to either add to the query string generated by the debug buttons here or add debug buttons of their own.
Comment 7 Baptiste Wojtkowski (bwoj) 2025-06-20 13:13:12 UTC
Created attachment 183392 [details] [review]
Bug 39142 Add debug permission to allow user to toggle JS and CSS customizations on/off

Database changes for 39142

Signed-off-by: Lari Strand <lari.strand@koha-suomi.fi>
Comment 8 Baptiste Wojtkowski (bwoj) 2025-06-20 13:13:14 UTC
Created attachment 183393 [details] [review]
Bug 39142: Add debug permission to allow user to toggle JS and CSS customizations on/off

to test:
1. apply the patch
2. use updatedatabase run to update your db
3. add custom JS and CSS in the IntranetUserJS and IntranetUserCSS fields
4. with as SuperLibrarian account confirm you have 3 buttons at the bottom of
    your screen, Disable User JS, Disable User CSS, and load only default
    stylesheets
5. clicking the buttons should reload the current page with a query to
    disable those things.
6. Log in as a user that is not a superlibrarian and does not have the
    debug UI permission enabled
7. confirm the buttons are no longer visible
8. Add the debug UI permission to the user
9. confirm the debug buttons are now visible for that user.

Signed-off-by: Lari Strand <lari.strand@koha-suomi.fi>
Comment 9 Baptiste Wojtkowski (bwoj) 2025-06-20 13:14:10 UTC
Rebased on main. Waiting on feedback to PQA but looks good and working.
Comment 10 David Cook 2025-06-23 02:32:37 UTC
I was reflecting on this idea... and it doesn't really seem like a user "permission" but rather a user "preference".

This could be an opportunity to add a "borrower_ui_preferences" table for storing this sort of user preference.

--

Alternatively, there are other user preferences like language which are managed by cookies like KohaOpacLanguage (see the patches on Bug 39206 for other Koha managed cookies).

While I don't like the idea of adding more cookies to Koha... that could be an alternative path forward. 

--

As an aside, I'm trying to re-think Koha permission models, and something like this really sticks out. I suppose an argument could be made for it as a "view_debug_button" permission, but I think that's a stretch. If there were a permission, it would be on the ability to disable those sysprefs and then the "view_debug_button" operation would be hinged off that permission, so that only people authorized to perform that operation could view that button.
Comment 11 Paul Derscheid 2025-06-23 13:56:59 UTC
I think it would make sense to introduce patron preferences as David said. Not sure whether this needs to necessarily be tied to just ui preferences, though.
Comment 12 David Cook 2025-06-25 01:21:43 UTC
On Mattermost, Lisette raised an interesting point. 

A permission would make sense, if the permission actually controlled the functionality added by bug 14004.
Comment 13 Martin Renvoize (ashimema) 2025-09-25 10:53:44 UTC
Created attachment 186913 [details] [review]
Bug 39142: Add debug permission

This patch adds the database foundation for the debug permission feature:
- Creates bit 31 in userflags table for 'debug' permission
- Updates mandatory userflags.sql for fresh installations
- Provides atomic update script for existing installations

The debug permission will allow authorized users to access debugging
tools for toggling JavaScript and CSS customizations.

Signed-off-by: Lari Strand <lari.strand@koha-suomi.fi>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Comment 14 Martin Renvoize (ashimema) 2025-09-25 10:53:46 UTC
Created attachment 186914 [details] [review]
Bug 39142: Add debug permission to allow user to toggle JS and CSS customizations on/off

To test:
1. Apply the patch
2. Use updatedatabase run to update your db
3. Add custom JS and CSS in the IntranetUserJS and IntranetUserCSS fields
4. With a superLibrarian account confirm you have 3 buttons at the bottom of
   your screen, Disable User JS, Disable User CSS, and load only default
   stylesheets
5. Clicking the buttons should reload the current page with a query to
   disable those things.
6. Log in as a user that is not a superlibrarian and does not have the
   debug UI permission enabled
7. Confirm the buttons are no longer visible
8. Add the debug UI permission to the user
9. Confirm the debug buttons are now visible for that user.

Signed-off-by: Lari Strand <lari.strand@koha-suomi.fi>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Comment 15 Martin Renvoize (ashimema) 2025-09-25 10:53:49 UTC
Created attachment 186915 [details] [review]
Bug 39142: (QA follow-up) Add unit tests for DISABLE_SYSPREF permission checking

This commit adds a unit test for the syspref override permission checking
functionality to ensure:

- Users without debug permission cannot override system preferences via URL parameters
- Users with debug permission can successfully override system preferences
- Superlibrarians maintain their ability to override system preferences
- The permission checking logic works correctly with haspermission()

The test creates three test patrons:
1. Regular patron with only catalogue permission (should be denied)
2. Patron with debug permission (should be allowed)
3. Superlibrarian (should be allowed)

Tests verify both the permission checking and the actual environment variable
setting that controls syspref overrides.

Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Comment 16 Martin Renvoize (ashimema) 2025-09-25 10:53:51 UTC
Created attachment 186916 [details] [review]
Bug 39142: (QA follow-up) Add permission checking for syspref overrides

This follow-up adds proper security controls for the DISABLE_SYSPREF_*
URL parameter functionality introduced in Bug 14004. Previously, any
user could bypass system preferences by using URL parameters without
authorization.

Changes:
- Restricts DISABLE_SYSPREF_* parameter processing to users with debug permission
- Uses existing haspermission() method for consistent authorization checking
- Maintains superlibrarian access as expected
- Closes potential security loophole where unauthorized users could disable
  system preferences like IntranetUserJS and IntranetUserCSS

The debug UI buttons will only appear for authorized users, and now the
underlying syspref override functionality requires the same permission,
ensuring both UI and functional security are aligned.

Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Comment 17 Martin Renvoize (ashimema) 2025-09-25 10:55:34 UTC
I decided to take over on QA here. I felt we should add a follow-up to use the permission as a permission and properly close off a loophole.

I really like the idea of a new table with user preferences etc, but I think that should take a new bug and discussion.

Code wise, I'm happy now and with the follow-ups I feel we're in a good position to PQA
Comment 18 Lucas Gass (lukeg) 2025-09-29 13:54:56 UTC
Nitpicking here but please have a look at the coding guidelines for when to use upper case vs lower case strings:

https://wiki.koha-community.org/wiki/Coding_Guidelines#HTML4:_Upper_and_lower_cases_in_strings