[Bug 35445] New: OPAC registration verification triggered by email URL scanners
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 Bug ID: 35445 Summary: OPAC registration verification triggered by email URL scanners Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Patrons Assignee: koha-bugs@lists.koha-community.org Reporter: dcook@prosentient.com.au QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com, kyle.m.hall@gmail.com I've noticed that Microsoft Safe Links is triggering /cgi-bin/koha/opac-registration-verify.pl?token=X links. This means that the end user ends up seeing "Registration invalid" because the Microsoft link scanner has already verified the registration by hitting the page with a GET. We should update opac-registration-verify.pl so that it requires the user to click a button for a POST form confirming their registration. (NOTE: Since opac-registration-verify.pl performs a state change, it should be a POST anyway.) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |dcook@prosentient.com.au |ity.org | Severity|enhancement |minor --- Comment #1 from David Cook <dcook@prosentient.com.au> --- Basically, /cgi-bin/koha/opac-registration-verify.pl?token=X will take us to a HTML form where the token is a hidden form field, and we'll have another input to indicate that we're confirming the registration. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=34478 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 --- Comment #2 from David Cook <dcook@prosentient.com.au> --- Created attachment 159516 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=159516&action=edit Bug 35445: Require OPAC user to confirm self-registration with button push This change requires the OPAC user to confirm self-registration with a button push when verifying registration using an emailed token. Test plan: 0. Apply the patch and koha-plack --reload kohadev 1. Set syspref PatronSelfRegistrationVerifyByEmail to "Don't require" 2. Create a patron using the self-registration on the OPAC 3. Note that no confirmation step is needed when self-registering 4. Set syspref PatronSelfRegistrationVerifyByEmail to "Require" 5. Create a patron using the self-registration on the OPAC 6. Look in message_queue to find the URL with the token to visit in the browser 7. Visit that URL 8. Note that the page says "Registration pending" and asks you to click a button labeled "Confirm" 9. Click the button labeled "Confirm" 10. Note that the self-registration is confirmed and details are shown on the page -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #159516|0 |1 is obsolete| | --- Comment #3 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 159520 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=159520&action=edit Bug 35445: Require OPAC user to confirm self-registration with button push This change requires the OPAC user to confirm self-registration with a button push when verifying registration using an emailed token. Test plan: 0. Apply the patch and koha-plack --reload kohadev 1. Set syspref PatronSelfRegistrationVerifyByEmail to "Don't require" 2. Create a patron using the self-registration on the OPAC 3. Note that no confirmation step is needed when self-registering 4. Set syspref PatronSelfRegistrationVerifyByEmail to "Require" 5. Create a patron using the self-registration on the OPAC 6. Look in message_queue to find the URL with the token to visit in the browser 7. Visit that URL 8. Note that the page says "Registration pending" and asks you to click a button labeled "Confirm" 9. Click the button labeled "Confirm" 10. Note that the self-registration is confirmed and details are shown on the page Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 --- Comment #4 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- All working as expected here, signing off. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |victor@tuxayo.net -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Comment #5 is|1 |0 private| | Comment #6 is|1 |0 private| | --- Comment #7 from Victor Grousset/tuxayo <victor@tuxayo.net> ---
That mail server rewrites the URL to point to Microsoft Safe Links or Web CISCO or whatever. Then when the user clicks the link in the email, Microsoft Safe Links or WEB CISCO or whatever visits it first, verifies that it's OK, and then redirects the user to the original link.
Great, nothing to worry about then :D Since these tools don't click on the link on their own in advance. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |tomascohen@gmail.com |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #159520|0 |1 is obsolete| | --- Comment #8 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 161476 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=161476&action=edit Bug 35445: Require OPAC user to confirm self-registration with button push This change requires the OPAC user to confirm self-registration with a button push when verifying registration using an emailed token. Test plan: 0. Apply the patch and koha-plack --reload kohadev 1. Set syspref PatronSelfRegistrationVerifyByEmail to "Don't require" 2. Create a patron using the self-registration on the OPAC 3. Note that no confirmation step is needed when self-registering 4. Set syspref PatronSelfRegistrationVerifyByEmail to "Require" 5. Create a patron using the self-registration on the OPAC 6. Look in message_queue to find the URL with the token to visit in the browser 7. Visit that URL 8. Note that the page says "Registration pending" and asks you to click a button labeled "Confirm" 9. Click the button labeled "Confirm" 10. Note that the self-registration is confirmed and details are shown on the page Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|tomascohen@gmail.com |m.de.rooy@rijksmuseum.nl -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to master Version(s)| |24.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 --- Comment #9 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 --- Comment #10 from David Cook <dcook@prosentient.com.au> --- Yay! I'd love to see this one in 23.11 as well :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart+koha@gmail. | |com --- Comment #11 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Should not we adjust opac-shareshelf.pl as well? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 --- Comment #12 from David Cook <dcook@prosentient.com.au> --- (In reply to Jonathan Druart from comment #11)
Should not we adjust opac-shareshelf.pl as well?
I'm not familiar with that one, but if it works similarly then I'd say you're right. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 --- Comment #13 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Jonathan Druart from comment #11)
Should not we adjust opac-shareshelf.pl as well?
Will have a look at that marvelous script :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to master |Pushed to stable Version(s)|24.05.00 |24.05.00,23.11.03 released in| | CC| |fridolin.somers@biblibre.co | |m --- Comment #14 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to 23.11.x for 23.11.03 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |35992 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35992 [Bug 35992] opac-shareshelf: Accepting invitation should not be triggered directly -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 --- Comment #15 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Marcel de Rooy from comment #13)
(In reply to Jonathan Druart from comment #11)
Should not we adjust opac-shareshelf.pl as well?
Will have a look at that marvelous script :)
Opened a new bug 35992, but will wait first for changes from 34478. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC|martin.renvoize@ptfs-europe | |.com | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 --- Comment #16 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Marcel de Rooy from comment #15)
(In reply to Marcel de Rooy from comment #13)
(In reply to Jonathan Druart from comment #11)
Should not we adjust opac-shareshelf.pl as well?
Will have a look at that marvelous script :)
Opened a new bug 35992, but will wait first for changes from 34478.
Ah. Should revive that. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |RESOLVED CC| |lucas@bywatersolutions.com Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 Lari Taskula <lari.taskula@hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |37692 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 [Bug 37692] Self-registration verification cannot be done if OPACPublic is not allowed -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org