Bug 39372 - No way to restrict OPAC users from creating private lists specifically
Summary: No way to restrict OPAC users from creating private lists specifically
Status: Signed Off
Alias: None
Product: Koha
Classification: Unclassified
Component: Lists (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: David Cook
QA Contact: Testopia
URL:
Keywords:
Depends on: 39404
Blocks:
  Show dependency treegraph
 
Reported: 2025-03-19 02:28 UTC by David Cook
Modified: 2025-04-23 07:42 UTC (History)
2 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 39372: Limit OPAC list creation (17.96 KB, patch)
2025-03-20 05:24 UTC, David Cook
Details | Diff | Splinter Review
Bug 39372: Database changes (1.62 KB, patch)
2025-03-20 05:57 UTC, David Cook
Details | Diff | Splinter Review
Bug 39372: Database changes (2.67 KB, patch)
2025-03-21 00:13 UTC, David Cook
Details | Diff | Splinter Review
Bug 39372: (follow-up) Fix toolbar and public/private selector (2.33 KB, patch)
2025-04-23 04:45 UTC, David Cook
Details | Diff | Splinter Review
Bug 39372: (follow-up) Add sysprefs to controller scripts (2.18 KB, patch)
2025-04-23 04:45 UTC, David Cook
Details | Diff | Splinter Review
Bug 39372: Limit OPAC list creation (18.38 KB, patch)
2025-04-23 07:42 UTC, Marion Durand
Details | Diff | Splinter Review
Bug 39372: Database changes (2.73 KB, patch)
2025-04-23 07:42 UTC, Marion Durand
Details | Diff | Splinter Review
Bug 39372: (follow-up) Fix toolbar and public/private selector (2.38 KB, patch)
2025-04-23 07:42 UTC, Marion Durand
Details | Diff | Splinter Review
Bug 39372: (follow-up) Add sysprefs to controller scripts (2.23 KB, patch)
2025-04-23 07:42 UTC, Marion Durand
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2025-03-19 02:28:37 UTC
There are cases where you want library staff users to create and share lists with OPAC users, but you don't want users to be able to create *any* lists.

Koha already has a syspref called OpacAllowPublicListCreation to restrict public list creation, but we also need something like OpacAllowPrivateListCreation to restrict private list creation.
Comment 1 David Cook 2025-03-19 02:30:58 UTC
I think by default we'd have to set OpacAllowPrivateListCreation to 1 because that is the status quo.
Comment 2 David Cook 2025-03-19 02:44:08 UTC Comment hidden (obsolete)
Comment 3 David Cook 2025-03-19 02:50:39 UTC Comment hidden (obsolete)
Comment 4 David Cook 2025-03-20 03:02:59 UTC Comment hidden (obsolete)
Comment 5 David Cook 2025-03-20 04:02:55 UTC Comment hidden (obsolete)
Comment 6 David Cook 2025-03-20 05:15:35 UTC
(In reply to David Cook from comment #4)
> - Masthead : "Lists" dropdown menu

Show "New list" if OpacAllowPrivateListCreation || OpacAllowPublicListCreation

> - Search results : "Add to list", "Save to lists"

Show "Save to lists" if OpacAllowPrivateListCreation || OpacAllowPublicListCreation
koha-tmpl/opac-tmpl/bootstrap/en/includes/title-actions-menu.inc

Show "Add to list" if OpacAllowPrivateListCreation || OpacAllowPublicListCreation
koha-tmpl/opac-tmpl/bootstrap/en/includes/result-batch-controls.inc

> - Detail page : "Save to your lists"

Show "Save to your lists" if OpacAllowPrivateListCreation || OpacAllowPublicListCreation

Show new list form only if OpacAllowPrivateListCreation || OpacAllowPublicListCreation
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt

> - Lists/Shelves : "New list", "Your lists", "Save to another list" and "Add to list"
> (for public lists)

Show "Save to another list" if OpacAllowPrivateListCreation || OpacAllowPublicListCreation

Show "New list" if OpacAllowPrivateListCreation || OpacAllowPublicListCreation

> - Cart : "Add to a list"

Show "Add to a list" if OpacAllowPrivateListCreation || OpacAllowPublicListCreation
Comment 7 David Cook 2025-03-20 05:24:47 UTC
Created attachment 179497 [details] [review]
Bug 39372: Limit OPAC list creation

This change adds a new system preference OpacAllowPrivateListCreation,
which works with the existing system preference OpacAllowPublicListCreation,
to determine when "New list", "Save to lists", "Add to list", "Save to another list",
and "Add to a list" should appear.

If both sysprefs are disabled, then you cannot do these actions. If one of the sysprefs
is enabled, then these actions appear, but are limited to the private or public list type
respective to the syspref.

Test plan:
0. Apply the patch and koha-plack --restart kohadev
1. Perform the following steps using differing combinations of OpacAllowPrivateListCreation,
or OpacAllowPublicListCreation, or both disabled
2. Click on Lists in masthead nav and note presence of "New list" link
3. Perform a search
4. Note the presence of "Save to lists" and "Add to list" links
5. Go to a record detail page
6. Note the presence of "Save to your lists" on the sidebar
7. Create a list
8. Go to the list
9. Note the presence of "Save to another list" and "New list" links
10. Add a record to the cart
11. Note the presence of "Add to a list" link
Comment 8 David Cook 2025-03-20 05:25:38 UTC
Database changes to follow shortly...
Comment 9 David Cook 2025-03-20 05:57:33 UTC
Created attachment 179498 [details] [review]
Bug 39372: Database changes
Comment 10 David Cook 2025-03-20 06:01:20 UTC
If you already have lists belonging to you, you'll be able to edit or delete them... but you can't create new lists or add to your existing lists.
Comment 11 David Cook 2025-03-20 06:09:02 UTC
I reckon there's probably more work to do here. Lists are a bit of a mess...
Comment 12 David Cook 2025-03-20 06:16:48 UTC
I think there's a few bugs with OpacAllowPublicListCreation before this patch as well... it's not a comprehensive syspref...
Comment 13 David Cook 2025-03-21 00:13:33 UTC
Created attachment 179566 [details] [review]
Bug 39372: Database changes
Comment 14 Marion Durand 2025-04-03 13:57:38 UTC
Is this patch ready to be signed off or does it still need work before ?
Comment 15 David Cook 2025-04-03 22:21:43 UTC
(In reply to Marion Durand from comment #14)
> Is this patch ready to be signed off or does it still need work before ?

It should be ready to be tested and signed off.
Comment 16 Marion Durand 2025-04-04 08:51:04 UTC
I tested your patch with ktd.

It worked well for the following combination
   private don't allow; public don't allow
   private allow; public don't allow
   private allow; public allow

I had a problem with the combination : 
   private don't allow, public allow
In this case, I was still able to create private lists even with the preference system on don't allow.

Could you provide a follow-up to address this issue?
Comment 17 David Cook 2025-04-06 23:40:11 UTC
(In reply to Marion Durand from comment #16)
> I had a problem with the combination : 
>    private don't allow, public allow
> In this case, I was still able to create private lists even with the
> preference system on don't allow.
> 
> Could you provide a follow-up to address this issue?

Thanks for testing! I'll look at doing a follow-up later this week or next week.
Comment 18 David Cook 2025-04-23 03:37:24 UTC
(In reply to Marion Durand from comment #16)
> I tested your patch with ktd.
> 
> It worked well for the following combination
>    private don't allow; public don't allow
>    private allow; public don't allow
>    private allow; public allow
> 
> I had a problem with the combination : 
>    private don't allow, public allow
> In this case, I was still able to create private lists even with the
> preference system on don't allow.
> 
> Could you provide a follow-up to address this issue?

Sorry for the delay on this one. I think that I see the issue now.

It also looks like when Public is disabled and Private is enabled, there is a "New list" that appears on the Public tab, but it actually just creates a Private list. I'll look at that too...
Comment 19 David Cook 2025-04-23 04:45:14 UTC
Changing this to enhancement like bug 39374
Comment 20 David Cook 2025-04-23 04:45:36 UTC
Created attachment 181333 [details] [review]
Bug 39372: (follow-up) Fix toolbar and public/private selector

On the lists page, it makes the "New list" link appear on the correct
tab as per the sysprefs regarding Private/Public list creation.

It also fixes the Public/Private "Category" dropdown menu when
creating a new list, so that the options match the sysprefs.
Comment 21 David Cook 2025-04-23 04:45:39 UTC
Created attachment 181334 [details] [review]
Bug 39372: (follow-up) Add sysprefs to controller scripts

By adding the sysprefs to the controller scripts, we can prevent
accidental creations or malicious creations. In theory, these error
conditions shouldn't be triggered, since only the allowed actions
will be displayed on the UI, but we need to cover all our bases.

The error messages in opac-shelves.pl aren't currently translatable.
The error handling will need some refactoring to make them translatable.
However, in this particular case, it should be OK, since no one but a
pen tester should bump into this message.
Comment 22 David Cook 2025-04-23 04:46:00 UTC
(In reply to Marion Durand from comment #16)
> I tested your patch with ktd.
> 
> It worked well for the following combination
>    private don't allow; public don't allow
>    private allow; public don't allow
>    private allow; public allow
> 
> I had a problem with the combination : 
>    private don't allow, public allow
> In this case, I was still able to create private lists even with the
> preference system on don't allow.
> 
> Could you provide a follow-up to address this issue?

Thanks again, Marion.

Can you give it another go? It should be better now. Thanks!
Comment 23 Marion Durand 2025-04-23 07:42:11 UTC
Created attachment 181336 [details] [review]
Bug 39372: Limit OPAC list creation

This change adds a new system preference OpacAllowPrivateListCreation,
which works with the existing system preference OpacAllowPublicListCreation,
to determine when "New list", "Save to lists", "Add to list", "Save to another list",
and "Add to a list" should appear.

If both sysprefs are disabled, then you cannot do these actions. If one of the sysprefs
is enabled, then these actions appear, but are limited to the private or public list type
respective to the syspref.

Test plan:
0. Apply the patch and koha-plack --restart kohadev
1. Perform the following steps using differing combinations of OpacAllowPrivateListCreation,
or OpacAllowPublicListCreation, or both disabled
2. Click on Lists in masthead nav and note presence of "New list" link
3. Perform a search
4. Note the presence of "Save to lists" and "Add to list" links
5. Go to a record detail page
6. Note the presence of "Save to your lists" on the sidebar
7. Create a list
8. Go to the list
9. Note the presence of "Save to another list" and "New list" links
10. Add a record to the cart
11. Note the presence of "Add to a list" link

Signed-off-by: Marion Durand <marion.durand@biblibre.com>
Comment 24 Marion Durand 2025-04-23 07:42:16 UTC
Created attachment 181337 [details] [review]
Bug 39372: Database changes

Signed-off-by: Marion Durand <marion.durand@biblibre.com>
Comment 25 Marion Durand 2025-04-23 07:42:19 UTC
Created attachment 181338 [details] [review]
Bug 39372: (follow-up) Fix toolbar and public/private selector

On the lists page, it makes the "New list" link appear on the correct
tab as per the sysprefs regarding Private/Public list creation.

It also fixes the Public/Private "Category" dropdown menu when
creating a new list, so that the options match the sysprefs.

Signed-off-by: Marion Durand <marion.durand@biblibre.com>
Comment 26 Marion Durand 2025-04-23 07:42:22 UTC
Created attachment 181339 [details] [review]
Bug 39372: (follow-up) Add sysprefs to controller scripts

By adding the sysprefs to the controller scripts, we can prevent
accidental creations or malicious creations. In theory, these error
conditions shouldn't be triggered, since only the allowed actions
will be displayed on the UI, but we need to cover all our bases.

The error messages in opac-shelves.pl aren't currently translatable.
The error handling will need some refactoring to make them translatable.
However, in this particular case, it should be OK, since no one but a
pen tester should bump into this message.

Signed-off-by: Marion Durand <marion.durand@biblibre.com>