[Bug 15050] New: Nonpublic note searchable from OPAC
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15050 Bug ID: 15050 Summary: Nonpublic note searchable from OPAC Change sponsored?: --- Product: Koha Version: 3.20 Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Cataloging Assignee: gmcharlt@gmail.com Reporter: mirko@abunchofthings.net QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl Text in the Nonpublic note can be found via OPAC. The text is not displayed, but if you know what you are looking for, you still get the information. Found in 3.20, I assume it is still valid in master. Bug 13023 does not fix it. To reproduce, put something unique in an item's nonpublic note. Re-index. Search from the OPAC -> you will find the title your item belongs to. Delete the nonpublic note and reindex, you can't find it anymore. Don't know if this qualifies as a security risk. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15050 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |veron@veron.ch --- Comment #1 from Marc Véron <veron@veron.ch> --- Reproduced on current master 3.21.00.041 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15050 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@bugs.koha-c | |ommunity.org Version|3.20 |master --- Comment #2 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- How important is this one? Should we completely remove itemnotes_nonpublic from the indexed fields? -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15050 --- Comment #3 from Mirko Tietgen <mirko@abunchofthings.net> --- I think we should not index it. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15050 --- Comment #4 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Are you sure it happens with the current zebra config? I get the problem with a UNIMARC install, but there is: 1437 <!--995 item # just to index every subfield--> 1438 <index_data_field tag="995"> 1439 <target_index>item:w</target_index> 1440 </index_data_field> In etc/zebradb/marc_defs/unimarc/biblios/biblio-koha-indexdefs.xml I don't see anything similar for MARC21. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15050 --- Comment #5 from Mirko Tietgen <mirko@abunchofthings.net> --- IIRC it is in items.more_subfields_xml and ends up in the index that way. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15050 --- Comment #6 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- It should not if it's mapped with a DB field (bug 13023). -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15050 --- Comment #7 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Mirko Tietgen from comment #0)
Don't know if this qualifies as a security risk. No, I would not call it like that :)
Please have a look at bug 12872. It is broader but covers this bug too. The problem is that DOM indexes all under the Any keyword via the following lines: <xslo:template mode="index_all" match="text()"> <z:index name="Any:w Any:p"> <xslo:value-of select="."/> </z:index> </xslo:template> Look at the first obsolete patch too. As discussed before on some older reports too, it would be nice to have an optional Anywhere (just like Any now), and a more restricted Any (only include the defined indexes as we were used too under GRS1). If you would not like Anywhere for various reasons (index size or hidden fields etc.), disable it some way. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15050 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |http://bugs.koha-community. | |org/bugzilla3/show_bug.cgi? | |id=12872 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15050 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de --- Comment #8 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Hm, my impression was that Any includes everything that is included in one of the other indexes - could there be another reason for the phenomenon? -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15050 --- Comment #9 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Argh, ignore my last comment. I think this is a difference between GRS1 and DOM indexing? -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15050 --- Comment #10 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Katrin Fischer from comment #9)
Argh, ignore my last comment. I think this is a difference between GRS1 and DOM indexing?
Right: as we were used too under GRS1... -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org