Bug 39336 - Public Biblio endpoint should honour OpacSuppression syspref
Summary: Public Biblio endpoint should honour OpacSuppression syspref
Status: Pushed to main
Alias: None
Product: Koha
Classification: Unclassified
Component: REST API (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major
Assignee: Martin Renvoize (ashimema)
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on: 38330
Blocks:
  Show dependency treegraph
 
Reported: 2025-03-14 16:03 UTC by Martin Renvoize (ashimema)
Modified: 2025-10-31 01:13 UTC (History)
3 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Crowdfunding goal: 0
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
25.11.00
Circulation function:


Attachments
Bug 39336: Public Biblio endpoint should honour OpacSuppression syspref (4.12 KB, patch)
2025-10-09 14:25 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review
Bug 39336: Public Biblio endpoint should honour OpacSuppression syspref (4.17 KB, patch)
2025-10-21 04:38 UTC, David Cook
Details | Diff | Splinter Review
Bug 39336: Public Biblio endpoint should honour OpacSuppression syspref (4.27 KB, patch)
2025-10-24 07:26 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Renvoize (ashimema) 2025-03-14 16:03:15 UTC
At the moment, if a record is suppressed in Koha it will still be accessible using the public get biblio endpoint... as the 'public' endpoint is in effect the opac equivalent of the API, then I believe these should not allow return of the record.
Comment 1 Martin Renvoize (ashimema) 2025-10-09 14:25:00 UTC
Created attachment 187665 [details] [review]
Bug 39336: Public Biblio endpoint should honour OpacSuppression syspref

This patch makes the Public Biblio endpoint respect the OpacSuppression
system preference and the biblio.opac_suppressed field introduced in
Bug 38330.

When OpacSuppression is enabled and a biblio has opac_suppressed set to 1,
the endpoint now returns a 404 (Not Found) response instead of exposing
the bibliographic record.

Test plan:
1. Apply patch
2. Run: prove t/db_dependent/api/v1/biblios.t
3. Verify all tests pass, including the new OpacSuppression subtest
4. Test manually:
   - Enable OpacSuppression syspref
   - Set a biblio's opac_suppressed field to 1
   - Access /api/v1/public/biblios/{biblio_id}
   - Confirm it returns 404
   - Set opac_suppressed to 0
   - Confirm it returns 200 with the record
   - Disable OpacSuppression syspref
   - Confirm record is visible regardless of opac_suppressed value
Comment 2 David Cook 2025-10-21 04:38:45 UTC
Created attachment 188183 [details] [review]
Bug 39336: Public Biblio endpoint should honour OpacSuppression syspref

This patch makes the Public Biblio endpoint respect the OpacSuppression
system preference and the biblio.opac_suppressed field introduced in
Bug 38330.

When OpacSuppression is enabled and a biblio has opac_suppressed set to 1,
the endpoint now returns a 404 (Not Found) response instead of exposing
the bibliographic record.

Test plan:
1. Apply patch
2. Run: prove t/db_dependent/api/v1/biblios.t
3. Verify all tests pass, including the new OpacSuppression subtest
4. Test manually:
   - Enable OpacSuppression syspref
   - Set a biblio's opac_suppressed field to 1
   - Access /api/v1/public/biblios/{biblio_id}
   - Confirm it returns 404
   - Set opac_suppressed to 0
   - Confirm it returns 200 with the record
   - Disable OpacSuppression syspref
   - Confirm record is visible regardless of opac_suppressed value

Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 3 Marcel de Rooy 2025-10-24 07:26:29 UTC
Created attachment 188401 [details] [review]
Bug 39336: Public Biblio endpoint should honour OpacSuppression syspref

This patch makes the Public Biblio endpoint respect the OpacSuppression
system preference and the biblio.opac_suppressed field introduced in
Bug 38330.

When OpacSuppression is enabled and a biblio has opac_suppressed set to 1,
the endpoint now returns a 404 (Not Found) response instead of exposing
the bibliographic record.

Test plan:
1. Apply patch
2. Run: prove t/db_dependent/api/v1/biblios.t
3. Verify all tests pass, including the new OpacSuppression subtest
4. Test manually:
   - Enable OpacSuppression syspref
   - Set a biblio's opac_suppressed field to 1
   - Access /api/v1/public/biblios/{biblio_id}
   - Confirm it returns 404
   - Set opac_suppressed to 0
   - Confirm it returns 200 with the record
   - Disable OpacSuppression syspref
   - Confirm record is visible regardless of opac_suppressed value

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 4 Marcel de Rooy 2025-10-24 07:27:10 UTC
Not sure about major here btw
Comment 5 Lucas Gass (lukeg) 2025-10-24 13:58:55 UTC
Nice work everyone!

Pushed to main for 25.11
Comment 6 David Cook 2025-10-26 22:41:19 UTC
(In reply to Marcel de Rooy from comment #4)
> Not sure about major here btw

I think it's probably valid. One could argue that this is actually a security bug, because it involves information disclosure.

Some libraries have private information in records that should never be public. I've even heard of libraries that rely on OpacSuppression to protect them from being censured by authorities. 

For most libraries, it's probably minor, but it could be major for some I'd say.
Comment 7 Katrin Fischer 2025-10-27 06:34:49 UTC
Major is certainly correct here. 

Do we need to check other routes as well? Items with OpacHiddenItems?
Comment 8 David Cook 2025-10-27 23:13:48 UTC
(In reply to Katrin Fischer from comment #7)
> Major is certainly correct here. 
> 
> Do we need to check other routes as well? Items with OpacHiddenItems?

Yeah, that would be a good idea to check.
Comment 9 David Cook 2025-10-31 01:13:01 UTC
(In reply to David Cook from comment #8)
> (In reply to Katrin Fischer from comment #7)
> > Major is certainly correct here. 
> > 
> > Do we need to check other routes as well? Items with OpacHiddenItems?
> 
> Yeah, that would be a good idea to check.

Yeah, it already handles OpacHiddenItems a few lines lower on Koha/REST/V1/Biblios.pm so all good there.