https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33260 --- Comment #704 from Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> --- Hi all, Pushing this as is. The findings below are all within, or only triggered by, the new Notices management feature, which is off by default, and are small enough to be fixed in follow-up bugs, in time for 26.11 or later for 26.11.x. A) SHARE_INVITE content can be viewed and printed SHARE_INVITE contains a secret too: its link carries the invitation key for a private list, and anyone with that link can accept the share and read the list. Unlike PASSWORD_RESET, STAFF_PASSWORD_RESET, OPAC_REG_VERIFY and 2FA_OTP_TOKEN, its content is shown and printable in Notices management. 1) Set 'NoticesManagement' to 'Enable' and 'OpacAllowSharingPrivateLists' to 'Allow' 2) Log in to the OPAC as koha/koha (http://localhost:8080) 3) Click 'Lists' > 'Your lists' > 'New list', name 'My list', keep 'Private', click 'Save' (http://localhost:8080/cgi-bin/koha/opac-shelves.pl?op=add_form) 4) Click 'Lists' > 'Your lists', click the 'Share' link next to 'My list', enter 'friend@example.com' and click 'Send' (http://localhost:8080/cgi-bin/koha/opac-shelves.pl?op=list) 5) In a KTD shell, run: perl misc/cronjobs/process_message_queue.pl KTD has no mail server, so it prints an SMTP error and the invitation is now 'failed' 6) In the staff interface, go to 'More' > 'Tools' > 'Notices management' (http://localhost:8081/cgi-bin/koha/tools/notices.pl) 7) Click the subject 'Share list My list' 8) Confirm the preview shows the invitation link with its key, and the notice has a 'Print' button B) The conversion link in the 'Delivery note' is lost After 'Convert to print', the 'Delivery note' links the two notices. The link is lost when gather_print_notices.pl processes the print notice, and when the original notice is resent. 1) Set 'NoticesManagement' to 'Enable' 2) Edit patron 'koha' (cardnumber '42'), set 'Primary email' to 'test@example.com', click 'Save' (http://localhost:8081/cgi-bin/koha/members/memberentry.pl?op=edit_form&borrowernumber=51) 3) On the patron's page, click 'More' > 'Send welcome notice' 4) In a KTD shell, run: perl misc/cronjobs/process_message_queue.pl KTD has no mail server, so it prints an SMTP error and the notice is now 'failed' 5) Go to 'More' > 'Tools' > 'Notices management', click the 'Convert to print' button on the WELCOME notice (http://localhost:8081/cgi-bin/koha/tools/notices.pl) 6) Confirm the email notice says 'Converted to print notice X' and the new 'print' notice says 'Converted from notice Y' 7) In a KTD shell, run: perl misc/cronjobs/gather_print_notices.pl /tmp 8) Reload Notices management. Confirm the 'print' notice is now 'printed' and 'Converted from notice Y' is gone from its 'Delivery note' 9) Click the subject of the email notice, then the 'Resend' button. Confirm 'Converted to print notice X' is gone C) The patron's Notices tab and Notices management show different delivery notes for the same notice The two pages render the same notices from copied markup, which has already drifted: the patron's 'Notices' tab shows From/To on notices that Notices management doesn't. 1) Repeat steps 1) to 5) of B) above 2) On the patron's 'Notices' tab, confirm the converted email notice shows 'From:' and 'To:' in its 'Delivery note' (http://localhost:8081/cgi-bin/koha/members/notices.pl?borrowernumber=51) 3) In Notices management, confirm the same notice only shows 'Converted to print notice X' D) The Cypress spec leaves patron categories behind t/cypress/integration/Tools/NoticesManagement_spec.ts leaves the patron categories created by insertSamplePatron in the database after each run. 1) Go to 'Administration' > 'Patron categories' and note the categories (http://localhost:8081/cgi-bin/koha/admin/categories.pl) 2) Run: yarn cypress run --spec t/cypress/integration/Tools/NoticesManagement_spec.ts 3) Reload 'Patron categories'. Confirm there are new categories with random names E) 'Resend' is offered for notices without a patron In Notices management, the preview of a notice without a patron (e.g. the SHARE_INVITE from A) has a 'Resend' button. Clicking it lands on an empty Circulation page and the notice is not resent. 1) Repeat steps 1) to 7) of A) above 2) Confirm the preview has a 'Resend' button. Click it 3) Confirm you land on an empty Circulation page (circ/circulation.pl?borrowernumber=) and the notice was not resent F) Notices management does potential heavy work for every listed notice on each load Each listed notice renders a hidden frame with its full content, and runs its own queries for its patron and its notice template. With up to 1000 notices listed, that is up to 1000 hidden frames and over a thousand extra queries per page load. G) Also: - The '--help' of misc/cronjobs/gather_print_notices.pl still says '--send' changes the status from pending to sent, it is now 'printed' (the POD was updated, the option description was not). - The 'Convert to print' handling is duplicated. members/notices.pl and tools/notices.pl both have the same 'cud-convert_to_print' block: it calls $message->convert_to_print in a try/catch and turns the exceptions (Koha::Exceptions::Notice::NoConversionTemplate, Koha::Exceptions::Notice::ConversionTemplateError, anything else) into the same 'no_template' / 'template_error' / 'failed' result. members/notices.tt and tools/notices.tt then repeat the same alerts for each of those results. Please link the follow-up bugs to this (Depends On) so they can be tracked for 26.11. -- You are receiving this mail because: You are watching all bug changes.