At the moment, there's no way to prevent OPAC users from Sending lists. There are situations where you don't want your OPAC user to be able to generate emails, especially with user-generated content in the comments field.
Created attachment 179494 [details] [review] Bug 39374: Add feature to block sending of lists from OPAC This change adds a system preference OPACDisableSendList which disables the ability to send lists from the OPAC, and hides the "Send list" link on the opac-shelves.pl page. This is useful in situations where you do not want OPAC users to be able to generate emails to arbitrary addresses with arbitrary comments. Test plan: 0. Apply the patch and koha-plack --restart kohadev 1. Create a public list with at least one record and view it in the OPAC 2. Click "Send list" and note you can fill out boxes for "Email address" and "Comment" 3. Change syspref OPACDisableSendList to "Don't allow" and click "Send list" again 4. Note the popup window now says "You do not have permission to send this list." 5. Reload the list web page and notice "Send list" no longer appears on the toolbar next to "Print list"
Created attachment 179495 [details] [review] Bug 39374: Database changes
Created attachment 179983 [details] [review] Bug 39374: Add feature to block sending of lists from OPAC This change adds a system preference OPACDisableSendList which disables the ability to send lists from the OPAC, and hides the "Send list" link on the opac-shelves.pl page. This is useful in situations where you do not want OPAC users to be able to generate emails to arbitrary addresses with arbitrary comments. Test plan: 0. Apply the patch and koha-plack --restart kohadev 1. Create a public list with at least one record and view it in the OPAC 2. Click "Send list" and note you can fill out boxes for "Email address" and "Comment" 3. Change syspref OPACDisableSendList to "Don't allow" and click "Send list" again 4. Note the popup window now says "You do not have permission to send this list." 5. Reload the list web page and notice "Send list" no longer appears on the toolbar next to "Print list" Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Created attachment 179984 [details] [review] Bug 39374: Database changes Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Works well and I totally agree that admins should be able to prevent users from send mail However it is a bit weird to have a button that will anyway tell you that you don't have the right. The information should be at the level of the button. Hence, the patch should gray out the icon and add a tooltip or could even remove the button since it is a setting from the instance : no user have access to the functionnality if it is disabled on the opac.
(In reply to Baptiste Wojtkowski (bwoj) from comment #5) > However it is a bit weird to have a button that will anyway tell you that > you don't have the right. The information should be at the level of the > button. > > Hence, the patch should gray out the icon and add a tooltip or could even > remove the button since it is a setting from the instance : no user have > access to the functionnality if it is disabled on the opac. From memory, I thought that I was hiding/removing the button. Did I miss one? Let me know where it is and I'll nuke it. (I was trying to cover all bases, so that the Perl controller script would reject the action if someone managed to bypass the restriction in the view, or if they had a cached view or they were trying to send as someone was disabling it and so on.)
(In reply to David Cook from comment #1) > 3. Change syspref OPACDisableSendList to "Don't allow" and click "Send list" > again > 4. Note the popup window now says "You do not have permission to send this > list." > 5. Reload the list web page and notice "Send list" no longer appears on the > toolbar > next to "Print list" So yeah steps 3 and 4 are to prove that the controller enforces the restrict and step 5 is to prove that the button doesn't appear anymore? But yeah let me know if there's an issue with step 5 :D
Oh nvm it's fine, I stopped at 4 and was thinking it was weird :) I think the pref in the yaml file is missing
(In reply to Baptiste Wojtkowski (bwoj) from comment #8) > Oh nvm it's fine, I stopped at 4 and was thinking it was weird :) > > I think the pref in the yaml file is missing I'm not sure I understand what you're saying here. It's in the first patch?
Created attachment 181053 [details] [review] Bug 39374: Add feature to block sending of lists from OPAC This change adds a system preference OPACDisableSendList which disables the ability to send lists from the OPAC, and hides the "Send list" link on the opac-shelves.pl page. This is useful in situations where you do not want OPAC users to be able to generate emails to arbitrary addresses with arbitrary comments. Test plan: 0. Apply the patch and koha-plack --restart kohadev 1. Create a public list with at least one record and view it in the OPAC 2. Click "Send list" and note you can fill out boxes for "Email address" and "Comment" 3. Change syspref OPACDisableSendList to "Don't allow" and click "Send list" again 4. Note the popup window now says "You do not have permission to send this list." 5. Reload the list web page and notice "Send list" no longer appears on the toolbar next to "Print list" Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com> Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Created attachment 181054 [details] [review] Bug 39374: Database changes Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com> Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
I feel like this is more an enhancement than a bugfix. If you disagree, please add some notes! Small change I smuggled in: System preferences should end with a .
Pushed for 25.05! Well done everyone, thank you!
(In reply to Katrin Fischer from comment #12) > I feel like this is more an enhancement than a bugfix. If you disagree, > please add some notes! I suppose arguments could be made either way? In a way, I think it's a deficiency in the current system, so the lack of it could be considered as a bug. On the other hand, one could argue it's a new feature for new functionality previously not available. I think I'm fine leaving it as an enhancement. Personally, I'll backport it to my own 24.11 soon. It's small enough that anyone wanting it should be able to do that reasonably easily I hope.
It's up to the RMaints to decide for an enhancement, but I feel it's more appropriate that way. I was wondering, what about the cart email feature? Maybe for a future bug report?
(In reply to Katrin Fischer from comment #15) > It's up to the RMaints to decide for an enhancement, but I feel it's more > appropriate that way. > > I was wondering, what about the cart email feature? > > Maybe for a future bug report? Yeah, I think future bug report. For the project that spawned a lot of this work, I was able to just turn off the cart completely, so it wasn't as urgent as the lists where we wanted to still use lists, but use them with more finely grained controls.