[Bug 17218] New: New list add attempt while logged in as dbadmin should be prevented pre-emptively
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 Bug ID: 17218 Summary: New list add attempt while logged in as dbadmin should be prevented pre-emptively Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Lists Assignee: gmcharlt@gmail.com Reporter: indradg@l2c2.co.in QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl Right now it allows the Koha db admin login to attempt adding a new list. Only while trying to save it does it inform that it is not possible to do so. This is should be made pre-emptive right after the "+ New list" option is clicked. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 Indranil Das Gupta <indradg@l2c2.co.in> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|gmcharlt@gmail.com |indradg@l2c2.co.in -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 Aleisha Amohia <aleisha@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 --- Comment #1 from Aleisha Amohia <aleisha@catalyst.net.nz> --- Created attachment 62348 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=62348&action=edit Bug 17218: Stop DB user from clicking 'New list' button To test: 1) Log in as DB user 2) Go to Lists -> New list 3) Attempt to create a new list 4) Notice that you are only stopped once you've submitted the form 5) Go back to lists, apply patch and refresh page 6) Notice the 'New list' button is now disabled 7) Click it and confirm alert shows up Sponsored-by: Catalyst IT -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 Aleisha Amohia <aleisha@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|indradg@l2c2.co.in |aleisha@catalyst.net.nz Change sponsored?|--- |Sponsored CC| |aleisha@catalyst.net.nz -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA --- Comment #2 from Owen Leonard <oleonard@myacpl.org> --- This works well (although it needs a quick rebase). But I think there should also be a warning on the list add page (/virtualshelves/shelves.pl?op=add_form&referer=add_form) in case the user navigates directly to it. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 Aleisha Amohia <aleisha@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 --- Comment #3 from Aleisha Amohia <aleisha@catalyst.net.nz> --- Created attachment 66604 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=66604&action=edit Bug 17218: [FOLLOW-UP] Stop DB user from adding list by forcing URL To test: 1) Go to the url /virtualshelves/shelves.pl?op=add_form&referer=add_form 2) Confirm an error message shows and the Save button cannot be clicked Sponsored-by: Catalyst IT -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #62348|0 |1 is obsolete| | --- Comment #4 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 68155 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=68155&action=edit Bug 17218: Stop DB user from clicking 'New list' button To test: 1) Log in as DB user 2) Go to Lists -> New list 3) Attempt to create a new list 4) Notice that you are only stopped once you've submitted the form 5) Go back to lists, apply patch and refresh page 6) Notice the 'New list' button is now disabled 7) Click it and confirm alert shows up Sponsored-by: Catalyst IT Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #66604|0 |1 is obsolete| | --- Comment #5 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 68156 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=68156&action=edit Bug 17218: [FOLLOW-UP] Stop DB user from adding list by forcing URL To test: 1) Go to the url /virtualshelves/shelves.pl?op=add_form&referer=add_form 2) Confirm an error message shows and the Save button cannot be clicked Sponsored-by: Catalyst IT Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off CC| |katrin.fischer@bsz-bw.de --- Comment #6 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I didn't realize at first that this was for the staff side. :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Patch doesn't apply -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 Aleisha Amohia <aleisha@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #68155|0 |1 is obsolete| | --- Comment #7 from Aleisha Amohia <aleisha@catalyst.net.nz> --- Created attachment 72298 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=72298&action=edit Bug 17218: Stop DB user from clicking 'New list' button To test: 1) Log in as DB user 2) Go to Lists -> New list 3) Attempt to create a new list 4) Notice that you are only stopped once you've submitted the form 5) Go back to lists, apply patch and refresh page 6) Notice the 'New list' button is now disabled 7) Click it and confirm alert shows up Sponsored-by: Catalyst IT Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 Aleisha Amohia <aleisha@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #68156|0 |1 is obsolete| | --- Comment #8 from Aleisha Amohia <aleisha@catalyst.net.nz> --- Created attachment 72299 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=72299&action=edit Bug 17218: [FOLLOW-UP] Stop DB user from adding list by forcing URL To test: 1) Go to the url /virtualshelves/shelves.pl?op=add_form&referer=add_form 2) Confirm an error message shows and the Save button cannot be clicked Sponsored-by: Catalyst IT Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 Aleisha Amohia <aleisha@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|New list add attempt while |New list add attempt while |logged in as dbadmin should |logged in as dbadmin on |be prevented pre-emptively |staff side should be | |prevented pre-emptively Status|Patch doesn't apply |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 --- Comment #9 from M. Tompsett <mtompset@hotmail.com> --- Comment on attachment 72298 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=72298 Bug 17218: Stop DB user from clicking 'New list' button Review of attachment 72298: --> (https://bugs.koha-community.org/bugzilla3/page.cgi?id=splinter.html&bug=17218&attachment=72298) ----------------------------------------------------------------- ::: koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc @@ +10,5 @@
+ }); + [% END %] +}); + +[% IF op == 'view' %]
I don't understand this whole IF block's purpose. It seems like new unrelated code. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA CC| |mtompset@hotmail.com --- Comment #10 from M. Tompsett <mtompset@hotmail.com> --- http://localhost:8081/cgi-bin/koha/virtualshelves/addbybiblionumber.pl?newshelf=1&biblionumber=1 When you view the contents of an existing public list, there is a drop-down to add to cart or a new list. That creates a bunch of possible explosion points, like the kohadevbox link above. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 Aleisha Amohia <aleisha@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 --- Comment #11 from Aleisha Amohia <aleisha@catalyst.net.nz> --- Created attachment 72495 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=72495&action=edit Bug 17218: [FOLLOW-UP] Removing pointless code and putting checks in missed places To test: 1) Log in as admin 2) View contents of a public list 3) Click drop-down for 'Add to' - there should be no [New list] option 4) Click on an item in the list 5) Click drop-down for 'Add to' in nav bar, click List 6) There should be no option to add a new list in the pop-up window 7) Do a catalog search that will return multiple results 8) Click drop-down for 'Add to list' - there should be no New list option Sponsored-by: Catalyst IT -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #72298|0 |1 is obsolete| | --- Comment #12 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 72506 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=72506&action=edit Bug 17218: Stop DB user from clicking 'New list' button To test: 1) Log in as DB user 2) Go to Lists -> New list 3) Attempt to create a new list 4) Notice that you are only stopped once you've submitted the form 5) Go back to lists, apply patch and refresh page 6) Notice the 'New list' button is now disabled 7) Click it and confirm alert shows up Sponsored-by: Catalyst IT Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Mark Tompsett <mtompset@hotmail.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #72299|0 |1 is obsolete| | --- Comment #13 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 72507 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=72507&action=edit Bug 17218: [FOLLOW-UP] Stop DB user from adding list by forcing URL To test: 1) Go to the url /virtualshelves/shelves.pl?op=add_form&referer=add_form 2) Confirm an error message shows and the Save button cannot be clicked Sponsored-by: Catalyst IT Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Mark Tompsett <mtompset@hotmail.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #72495|0 |1 is obsolete| | --- Comment #14 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 72508 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=72508&action=edit Bug 17218: [FOLLOW-UP] Removing pointless code and putting checks in missed places To test: 1) Log in as admin 2) View contents of a public list 3) Click drop-down for 'Add to' - there should be no [New list] option 4) Click on an item in the list 5) Click drop-down for 'Add to' in nav bar, click List 6) There should be no option to add a new list in the pop-up window 7) Do a catalog search that will return multiple results 8) Click drop-down for 'Add to list' - there should be no New list option Sponsored-by: Catalyst IT Signed-off-by: Mark Tompsett <mtompset@hotmail.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off --- Comment #15 from M. Tompsett <mtompset@hotmail.com> --- NOTE: Javascript error, text/javascript in script tag not necessary for HTML5, and unless can get alert working I'll live with the disorienting click loading a page from a disabled button. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |BLOCKED --- Comment #16 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Moving to BLOCKED, since bug 20489 will no longer allow DB admin logins. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=20489 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|BLOCKED |RESOLVED --- Comment #17 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I believe this is resolved with bug 20489. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|master |17.11 CC| |fridolin.somers@biblibre.co | |m --- Comment #18 from M. Tompsett <mtompset@hotmail.com> --- I've added the 17.11 RM, Fridolin Somers, to this bug. I'll let the RM decide if this is worthy of leaving as Resolved Fixed, or whether this should be put into 17.11, because if we still have an RM for 17.11, then the issue was not resolved in all supported versions. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17218 --- Comment #19 from Fridolin SOMERS <fridolin.somers@biblibre.com> --- (In reply to M. Tompsett from comment #18)
I've added the 17.11 RM, Fridolin Somers, to this bug. I'll let the RM decide if this is worthy of leaving as Resolved Fixed, or whether this should be put into 17.11, because if we still have an RM for 17.11, then the issue was not resolved in all supported versions.
Indeed, i'm on RMaint for 17.11, but this is a real enhancement so I decide not to backport. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org