[Bug 39336] New: Public Biblio endpoint should honour OpacSuppression syspref
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 Bug ID: 39336 Summary: Public Biblio endpoint should honour OpacSuppression syspref Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: koha-bugs@lists.koha-community.org Reporter: martin.renvoize@ptfs-europe.com QA Contact: testopia@bugs.koha-community.org CC: tomascohen@gmail.com At the moment, if a record is suppressed in Koha it will still be accessible using the public get biblio endpoint... as the 'public' endpoint is in effect the opac equivalent of the API, then I believe these should not allow return of the record. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 Martin Renvoize (ashimema) <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |38330 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38330 [Bug 38330] Make bib-level suppression a biblio table field instead of part of a marc tag -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |martin.renvoize@openfifth.c |ity.org |o.uk -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 --- Comment #1 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 187665 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=187665&action=edit Bug 39336: Public Biblio endpoint should honour OpacSuppression syspref This patch makes the Public Biblio endpoint respect the OpacSuppression system preference and the biblio.opac_suppressed field introduced in Bug 38330. When OpacSuppression is enabled and a biblio has opac_suppressed set to 1, the endpoint now returns a 404 (Not Found) response instead of exposing the bibliographic record. Test plan: 1. Apply patch 2. Run: prove t/db_dependent/api/v1/biblios.t 3. Verify all tests pass, including the new OpacSuppression subtest 4. Test manually: - Enable OpacSuppression syspref - Set a biblio's opac_suppressed field to 1 - Access /api/v1/public/biblios/{biblio_id} - Confirm it returns 404 - Set opac_suppressed to 0 - Confirm it returns 200 with the record - Disable OpacSuppression syspref - Confirm record is visible regardless of opac_suppressed value -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |major -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #187665|0 |1 is obsolete| | --- Comment #2 from David Cook <dcook@prosentient.com.au> --- Created attachment 188183 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=188183&action=edit Bug 39336: Public Biblio endpoint should honour OpacSuppression syspref This patch makes the Public Biblio endpoint respect the OpacSuppression system preference and the biblio.opac_suppressed field introduced in Bug 38330. When OpacSuppression is enabled and a biblio has opac_suppressed set to 1, the endpoint now returns a 404 (Not Found) response instead of exposing the bibliographic record. Test plan: 1. Apply patch 2. Run: prove t/db_dependent/api/v1/biblios.t 3. Verify all tests pass, including the new OpacSuppression subtest 4. Test manually: - Enable OpacSuppression syspref - Set a biblio's opac_suppressed field to 1 - Access /api/v1/public/biblios/{biblio_id} - Confirm it returns 404 - Set opac_suppressed to 0 - Confirm it returns 200 with the record - Disable OpacSuppression syspref - Confirm record is visible regardless of opac_suppressed value Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |tomascohen@gmail.com |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #188183|0 |1 is obsolete| | --- Comment #3 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 188401 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=188401&action=edit Bug 39336: Public Biblio endpoint should honour OpacSuppression syspref This patch makes the Public Biblio endpoint respect the OpacSuppression system preference and the biblio.opac_suppressed field introduced in Bug 38330. When OpacSuppression is enabled and a biblio has opac_suppressed set to 1, the endpoint now returns a 404 (Not Found) response instead of exposing the bibliographic record. Test plan: 1. Apply patch 2. Run: prove t/db_dependent/api/v1/biblios.t 3. Verify all tests pass, including the new OpacSuppression subtest 4. Test manually: - Enable OpacSuppression syspref - Set a biblio's opac_suppressed field to 1 - Access /api/v1/public/biblios/{biblio_id} - Confirm it returns 404 - Set opac_suppressed to 0 - Confirm it returns 200 with the record - Disable OpacSuppression syspref - Confirm record is visible regardless of opac_suppressed value Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy@rijksmuseum.nl QA Contact|tomascohen@gmail.com |m.de.rooy@rijksmuseum.nl -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 --- Comment #4 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Not sure about major here btw -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |25.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 --- Comment #5 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Nice work everyone! Pushed to main for 25.11 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 --- Comment #6 from David Cook <dcook@prosentient.com.au> --- (In reply to Marcel de Rooy from comment #4)
Not sure about major here btw
I think it's probably valid. One could argue that this is actually a security bug, because it involves information disclosure. Some libraries have private information in records that should never be public. I've even heard of libraries that rely on OpacSuppression to protect them from being censured by authorities. For most libraries, it's probably minor, but it could be major for some I'd say. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 --- Comment #7 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Major is certainly correct here. Do we need to check other routes as well? Items with OpacHiddenItems? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 --- Comment #8 from David Cook <dcook@prosentient.com.au> --- (In reply to Katrin Fischer from comment #7)
Major is certainly correct here.
Do we need to check other routes as well? Items with OpacHiddenItems?
Yeah, that would be a good idea to check. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 --- Comment #9 from David Cook <dcook@prosentient.com.au> --- (In reply to David Cook from comment #8)
(In reply to Katrin Fischer from comment #7)
Major is certainly correct here.
Do we need to check other routes as well? Items with OpacHiddenItems?
Yeah, that would be a good idea to check.
Yeah, it already handles OpacHiddenItems a few lines lower on Koha/REST/V1/Biblios.pm so all good there. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|25.11.00 |25.11.00,25.05.06 released in| | Status|Pushed to main |Pushed to stable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 --- Comment #10 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Nice work everyone! Pushed to 25.05.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |paul.derscheid@lmscloud.de Version(s)|25.11.00,25.05.06 |25.11.00 released in| | --- Comment #11 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Reverted from 25.05.x, must have checked for a wrong bug number by when looking for the dependency. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |ASSIGNED CC| |lucas@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39336 Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Needs documenting CC| |wainuiwitikapark@catalyst.n | |et.nz -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org