At the moment, if a record is suppressed in Koha it will still be accessible using the public get biblio endpoint... as the 'public' endpoint is in effect the opac equivalent of the API, then I believe these should not allow return of the record.
Created attachment 187665 [details] [review] Bug 39336: Public Biblio endpoint should honour OpacSuppression syspref This patch makes the Public Biblio endpoint respect the OpacSuppression system preference and the biblio.opac_suppressed field introduced in Bug 38330. When OpacSuppression is enabled and a biblio has opac_suppressed set to 1, the endpoint now returns a 404 (Not Found) response instead of exposing the bibliographic record. Test plan: 1. Apply patch 2. Run: prove t/db_dependent/api/v1/biblios.t 3. Verify all tests pass, including the new OpacSuppression subtest 4. Test manually: - Enable OpacSuppression syspref - Set a biblio's opac_suppressed field to 1 - Access /api/v1/public/biblios/{biblio_id} - Confirm it returns 404 - Set opac_suppressed to 0 - Confirm it returns 200 with the record - Disable OpacSuppression syspref - Confirm record is visible regardless of opac_suppressed value
Created attachment 188183 [details] [review] Bug 39336: Public Biblio endpoint should honour OpacSuppression syspref This patch makes the Public Biblio endpoint respect the OpacSuppression system preference and the biblio.opac_suppressed field introduced in Bug 38330. When OpacSuppression is enabled and a biblio has opac_suppressed set to 1, the endpoint now returns a 404 (Not Found) response instead of exposing the bibliographic record. Test plan: 1. Apply patch 2. Run: prove t/db_dependent/api/v1/biblios.t 3. Verify all tests pass, including the new OpacSuppression subtest 4. Test manually: - Enable OpacSuppression syspref - Set a biblio's opac_suppressed field to 1 - Access /api/v1/public/biblios/{biblio_id} - Confirm it returns 404 - Set opac_suppressed to 0 - Confirm it returns 200 with the record - Disable OpacSuppression syspref - Confirm record is visible regardless of opac_suppressed value Signed-off-by: David Cook <dcook@prosentient.com.au>
Created attachment 188401 [details] [review] Bug 39336: Public Biblio endpoint should honour OpacSuppression syspref This patch makes the Public Biblio endpoint respect the OpacSuppression system preference and the biblio.opac_suppressed field introduced in Bug 38330. When OpacSuppression is enabled and a biblio has opac_suppressed set to 1, the endpoint now returns a 404 (Not Found) response instead of exposing the bibliographic record. Test plan: 1. Apply patch 2. Run: prove t/db_dependent/api/v1/biblios.t 3. Verify all tests pass, including the new OpacSuppression subtest 4. Test manually: - Enable OpacSuppression syspref - Set a biblio's opac_suppressed field to 1 - Access /api/v1/public/biblios/{biblio_id} - Confirm it returns 404 - Set opac_suppressed to 0 - Confirm it returns 200 with the record - Disable OpacSuppression syspref - Confirm record is visible regardless of opac_suppressed value Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Not sure about major here btw
Nice work everyone! Pushed to main for 25.11
(In reply to Marcel de Rooy from comment #4) > Not sure about major here btw I think it's probably valid. One could argue that this is actually a security bug, because it involves information disclosure. Some libraries have private information in records that should never be public. I've even heard of libraries that rely on OpacSuppression to protect them from being censured by authorities. For most libraries, it's probably minor, but it could be major for some I'd say.
Major is certainly correct here. Do we need to check other routes as well? Items with OpacHiddenItems?
(In reply to Katrin Fischer from comment #7) > Major is certainly correct here. > > Do we need to check other routes as well? Items with OpacHiddenItems? Yeah, that would be a good idea to check.
(In reply to David Cook from comment #8) > (In reply to Katrin Fischer from comment #7) > > Major is certainly correct here. > > > > Do we need to check other routes as well? Items with OpacHiddenItems? > > Yeah, that would be a good idea to check. Yeah, it already handles OpacHiddenItems a few lines lower on Koha/REST/V1/Biblios.pm so all good there.