Bug 39374 - No way to restrict OPAC users from sending lists
Summary: No way to restrict OPAC users from sending lists
Status: Pushed to main
Alias: None
Product: Koha
Classification: Unclassified
Component: Lists (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: David Cook
QA Contact: Testopia
URL:
Keywords: release-notes-needed
Depends on:
Blocks:
 
Reported: 2025-03-19 03:00 UTC by David Cook
Modified: 2025-04-23 05:35 UTC (History)
3 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
New system preference "OPACDisableSendList" provides libraries the option to disable the ability to send lists from the OPAC, and hides the "Send list" link on the opac-shelves.pl page.
Version(s) released in:
25.05.00
Circulation function:


Attachments
Bug 39374: Add feature to block sending of lists from OPAC (4.61 KB, patch)
2025-03-20 02:06 UTC, David Cook
Details | Diff | Splinter Review
Bug 39374: Database changes (2.54 KB, patch)
2025-03-20 02:06 UTC, David Cook
Details | Diff | Splinter Review
Bug 39374: Add feature to block sending of lists from OPAC (4.67 KB, patch)
2025-03-31 11:57 UTC, Brendan Gallagher
Details | Diff | Splinter Review
Bug 39374: Database changes (2.60 KB, patch)
2025-03-31 11:57 UTC, Brendan Gallagher
Details | Diff | Splinter Review
Bug 39374: Add feature to block sending of lists from OPAC (4.72 KB, patch)
2025-04-17 09:39 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review
Bug 39374: Database changes (2.66 KB, patch)
2025-04-17 09:39 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2025-03-19 03:00:21 UTC
At the moment, there's no way to prevent OPAC users from Sending lists. 

There are situations where you don't want your OPAC user to be able to generate emails, especially with user-generated content in the comments field.
Comment 1 David Cook 2025-03-20 02:06:53 UTC
Created attachment 179494 [details] [review]
Bug 39374: Add feature to block sending of lists from OPAC

This change adds a system preference OPACDisableSendList which
disables the ability to send lists from the OPAC, and hides the
"Send list" link on the opac-shelves.pl page.

This is useful in situations where you do not want OPAC users to be
able to generate emails to arbitrary addresses with arbitrary comments.

Test plan:
0. Apply the patch and koha-plack --restart kohadev
1. Create a public list with at least one record and view it in the OPAC
2. Click "Send list" and note you can fill out boxes for "Email address"
and "Comment"
3. Change syspref OPACDisableSendList to "Don't allow" and click "Send list"
again
4. Note the popup window now says "You do not have permission to send this list."
5. Reload the list web page and notice "Send list" no longer appears on the toolbar
next to "Print list"
Comment 2 David Cook 2025-03-20 02:06:56 UTC
Created attachment 179495 [details] [review]
Bug 39374: Database changes
Comment 3 Brendan Gallagher 2025-03-31 11:57:37 UTC
Created attachment 179983 [details] [review]
Bug 39374: Add feature to block sending of lists from OPAC

This change adds a system preference OPACDisableSendList which
disables the ability to send lists from the OPAC, and hides the
"Send list" link on the opac-shelves.pl page.

This is useful in situations where you do not want OPAC users to be
able to generate emails to arbitrary addresses with arbitrary comments.

Test plan:
0. Apply the patch and koha-plack --restart kohadev
1. Create a public list with at least one record and view it in the OPAC
2. Click "Send list" and note you can fill out boxes for "Email address"
and "Comment"
3. Change syspref OPACDisableSendList to "Don't allow" and click "Send list"
again
4. Note the popup window now says "You do not have permission to send this list."
5. Reload the list web page and notice "Send list" no longer appears on the toolbar
next to "Print list"

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Comment 4 Brendan Gallagher 2025-03-31 11:57:40 UTC
Created attachment 179984 [details] [review]
Bug 39374: Database changes

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Comment 5 Baptiste Wojtkowski (bwoj) 2025-04-11 14:46:08 UTC
Works well and I totally agree that admins should be able to prevent users from send mail  

However it is a bit weird to have a button that will anyway tell you that you don't have the right. The information should be at the level of the button.

Hence, the patch should gray out the icon and add a tooltip or could even remove the button since it is a setting from the instance : no user have access to the functionnality if it is disabled on the opac.
Comment 6 David Cook 2025-04-13 23:24:39 UTC
(In reply to Baptiste Wojtkowski (bwoj) from comment #5)
> However it is a bit weird to have a button that will anyway tell you that
> you don't have the right. The information should be at the level of the
> button.
> 
> Hence, the patch should gray out the icon and add a tooltip or could even
> remove the button since it is a setting from the instance : no user have
> access to the functionnality if it is disabled on the opac.

From memory, I thought that I was hiding/removing the button. Did I miss one? Let me know where it is and I'll nuke it. 

(I was trying to cover all bases, so that the Perl controller script would reject the action if someone managed to bypass the restriction in the view, or if they had a cached view or they were trying to send as someone was disabling it and so on.)
Comment 7 David Cook 2025-04-13 23:26:05 UTC
(In reply to David Cook from comment #1)
> 3. Change syspref OPACDisableSendList to "Don't allow" and click "Send list"
> again
> 4. Note the popup window now says "You do not have permission to send this
> list."
> 5. Reload the list web page and notice "Send list" no longer appears on the
> toolbar
> next to "Print list"

So yeah steps 3 and 4 are to prove that the controller enforces the restrict and step 5 is to prove that the button doesn't appear anymore? 

But yeah let me know if there's an issue with step 5 :D
Comment 8 Baptiste Wojtkowski (bwoj) 2025-04-14 10:06:48 UTC
Oh nvm it's fine, I stopped at 4 and was thinking it was weird :)

I think the pref in the yaml file is missing
Comment 9 David Cook 2025-04-17 05:15:34 UTC
(In reply to Baptiste Wojtkowski (bwoj) from comment #8)
> Oh nvm it's fine, I stopped at 4 and was thinking it was weird :)
> 
> I think the pref in the yaml file is missing

I'm not sure I understand what you're saying here.

It's in the first patch?
Comment 10 Baptiste Wojtkowski (bwoj) 2025-04-17 09:39:27 UTC
Created attachment 181053 [details] [review]
Bug 39374: Add feature to block sending of lists from OPAC

This change adds a system preference OPACDisableSendList which
disables the ability to send lists from the OPAC, and hides the
"Send list" link on the opac-shelves.pl page.

This is useful in situations where you do not want OPAC users to be
able to generate emails to arbitrary addresses with arbitrary comments.

Test plan:
0. Apply the patch and koha-plack --restart kohadev
1. Create a public list with at least one record and view it in the OPAC
2. Click "Send list" and note you can fill out boxes for "Email address"
and "Comment"
3. Change syspref OPACDisableSendList to "Don't allow" and click "Send list"
again
4. Note the popup window now says "You do not have permission to send this list."
5. Reload the list web page and notice "Send list" no longer appears on the toolbar
next to "Print list"

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Comment 11 Baptiste Wojtkowski (bwoj) 2025-04-17 09:39:29 UTC
Created attachment 181054 [details] [review]
Bug 39374: Database changes

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Comment 12 Katrin Fischer 2025-04-22 06:40:28 UTC
I feel like this is more an enhancement than a bugfix. If you disagree, please add some notes!

Small change I smuggled in: System preferences should end with a .
Comment 13 Katrin Fischer 2025-04-22 06:50:28 UTC
Pushed for 25.05!

Well done everyone, thank you!
Comment 14 David Cook 2025-04-23 02:57:22 UTC
(In reply to Katrin Fischer from comment #12)
> I feel like this is more an enhancement than a bugfix. If you disagree,
> please add some notes!

I suppose arguments could be made either way? In a way, I think it's a deficiency in the current system, so the lack of it could be considered as a bug. On the other hand, one could argue it's a new feature for new functionality previously not available. 

I think I'm fine leaving it as an enhancement. Personally, I'll backport it to my own 24.11 soon. It's small enough that anyone wanting it should be able to do that reasonably easily I hope.
Comment 15 Katrin Fischer 2025-04-23 04:58:52 UTC
It's up to the RMaints to decide for an enhancement, but I feel it's more appropriate that way. 

I was wondering, what about the cart email feature?

Maybe for a future bug report?
Comment 16 David Cook 2025-04-23 05:35:34 UTC
(In reply to Katrin Fischer from comment #15)
> It's up to the RMaints to decide for an enhancement, but I feel it's more
> appropriate that way. 
> 
> I was wondering, what about the cart email feature?
> 
> Maybe for a future bug report?

Yeah, I think future bug report. For the project that spawned a lot of this work, I was able to just turn off the cart completely, so it wasn't as urgent as the lists where we wanted to still use lists, but use them with more finely grained controls.