[Bug 39372] New: No way to restrict OPAC users from creating private lists specifically
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 Bug ID: 39372 Summary: No way to restrict OPAC users from creating private lists specifically Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Lists Assignee: koha-bugs@lists.koha-community.org Reporter: dcook@prosentient.com.au QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl There are cases where you want library staff users to create and share lists with OPAC users, but you don't want users to be able to create *any* lists. Koha already has a syspref called OpacAllowPublicListCreation to restrict public list creation, but we also need something like OpacAllowPrivateListCreation to restrict private list creation. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #1 from David Cook <dcook@prosentient.com.au> --- I think by default we'd have to set OpacAllowPrivateListCreation to 1 because that is the status quo. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #2 from David Cook <dcook@prosentient.com.au> --- There's lots of different locations in Koha to keep in mind... - Masthead : "Lists" dropdown menu - Search results : "Select titles to: Add to...", "Save to lists" - Detail page : "Save to your lists" - Usermenu : "Lists" - Lists/Shelves : "Your lists" - Cart : "Add to a list" -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #3 from David Cook <dcook@prosentient.com.au> --- - Masthead : "Lists" dropdown menu - Search results : "Select titles to: Add to...", "Save to lists" - Detail page : "Save to your lists" - Usermenu : "Lists" - Lists/Shelves : "Your lists", "Save to another list" and "Add to list" (for public lists) - Cart : "Add to a list" -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #4 from David Cook <dcook@prosentient.com.au> --- - Masthead : "Lists" dropdown menu - Search results : "Select titles to: Add to...", "Save to lists" - Detail page : "Save to your lists" - Lists/Shelves : "Your lists", "Save to another list" and "Add to list" (for public lists) - Cart : "Add to a list" -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=39069 --- Comment #5 from David Cook <dcook@prosentient.com.au> --- (In reply to David Cook from comment #4)
- Masthead : "Lists" dropdown menu
Hidden "Your
- Search results : "Select titles to: Add to...", "Save to lists" - Detail page : "Save to your lists" - Lists/Shelves : "Your lists", "Save to another list" and "Add to list" (for public lists) - Cart : "Add to a list"
-- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #6 from David Cook <dcook@prosentient.com.au> --- (In reply to David Cook from comment #4)
- Masthead : "Lists" dropdown menu
Show "New list" if OpacAllowPrivateListCreation || OpacAllowPublicListCreation
- Search results : "Add to list", "Save to lists"
Show "Save to lists" if OpacAllowPrivateListCreation || OpacAllowPublicListCreation koha-tmpl/opac-tmpl/bootstrap/en/includes/title-actions-menu.inc Show "Add to list" if OpacAllowPrivateListCreation || OpacAllowPublicListCreation koha-tmpl/opac-tmpl/bootstrap/en/includes/result-batch-controls.inc
- Detail page : "Save to your lists"
Show "Save to your lists" if OpacAllowPrivateListCreation || OpacAllowPublicListCreation Show new list form only if OpacAllowPrivateListCreation || OpacAllowPublicListCreation koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt
- Lists/Shelves : "New list", "Your lists", "Save to another list" and "Add to list" (for public lists)
Show "Save to another list" if OpacAllowPrivateListCreation || OpacAllowPublicListCreation Show "New list" if OpacAllowPrivateListCreation || OpacAllowPublicListCreation
- Cart : "Add to a list"
Show "Add to a list" if OpacAllowPrivateListCreation || OpacAllowPublicListCreation -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #7 from David Cook <dcook@prosentient.com.au> --- Created attachment 179497 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179497&action=edit Bug 39372: Limit OPAC list creation This change adds a new system preference OpacAllowPrivateListCreation, which works with the existing system preference OpacAllowPublicListCreation, to determine when "New list", "Save to lists", "Add to list", "Save to another list", and "Add to a list" should appear. If both sysprefs are disabled, then you cannot do these actions. If one of the sysprefs is enabled, then these actions appear, but are limited to the private or public list type respective to the syspref. Test plan: 0. Apply the patch and koha-plack --restart kohadev 1. Perform the following steps using differing combinations of OpacAllowPrivateListCreation, or OpacAllowPublicListCreation, or both disabled 2. Click on Lists in masthead nav and note presence of "New list" link 3. Perform a search 4. Note the presence of "Save to lists" and "Add to list" links 5. Go to a record detail page 6. Note the presence of "Save to your lists" on the sidebar 7. Create a list 8. Go to the list 9. Note the presence of "Save to another list" and "New list" links 10. Add a record to the cart 11. Note the presence of "Add to a list" link -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #8 from David Cook <dcook@prosentient.com.au> --- Database changes to follow shortly... -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=35765 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #9 from David Cook <dcook@prosentient.com.au> --- Created attachment 179498 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179498&action=edit Bug 39372: Database changes -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|NEW |Needs Signoff Assignee|koha-bugs@lists.koha-commun |dcook@prosentient.com.au |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #10 from David Cook <dcook@prosentient.com.au> --- If you already have lists belonging to you, you'll be able to edit or delete them... but you can't create new lists or add to your existing lists. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #11 from David Cook <dcook@prosentient.com.au> --- I reckon there's probably more work to do here. Lists are a bit of a mess... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #12 from David Cook <dcook@prosentient.com.au> --- I think there's a few bugs with OpacAllowPublicListCreation before this patch as well... it's not a comprehensive syspref... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179498|0 |1 is obsolete| | --- Comment #13 from David Cook <dcook@prosentient.com.au> --- Created attachment 179566 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179566&action=edit Bug 39372: Database changes -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=39376 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=39238 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also|https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=39238 | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 Marion Durand <marion.durand@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |marion.durand@biblibre.com --- Comment #14 from Marion Durand <marion.durand@biblibre.com> --- Is this patch ready to be signed off or does it still need work before ? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #15 from David Cook <dcook@prosentient.com.au> --- (In reply to Marion Durand from comment #14)
Is this patch ready to be signed off or does it still need work before ?
It should be ready to be tested and signed off. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #16 from Marion Durand <marion.durand@biblibre.com> --- I tested your patch with ktd. It worked well for the following combination private don't allow; public don't allow private allow; public don't allow private allow; public allow I had a problem with the combination : private don't allow, public allow In this case, I was still able to create private lists even with the preference system on don't allow. Could you provide a follow-up to address this issue? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #17 from David Cook <dcook@prosentient.com.au> --- (In reply to Marion Durand from comment #16)
I had a problem with the combination : private don't allow, public allow In this case, I was still able to create private lists even with the preference system on don't allow.
Could you provide a follow-up to address this issue?
Thanks for testing! I'll look at doing a follow-up later this week or next week. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |39404 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39404 [Bug 39404] Inconsistency due to "Add to list" vs "Add to a list" -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #18 from David Cook <dcook@prosentient.com.au> --- (In reply to Marion Durand from comment #16)
I tested your patch with ktd.
It worked well for the following combination private don't allow; public don't allow private allow; public don't allow private allow; public allow
I had a problem with the combination : private don't allow, public allow In this case, I was still able to create private lists even with the preference system on don't allow.
Could you provide a follow-up to address this issue?
Sorry for the delay on this one. I think that I see the issue now. It also looks like when Public is disabled and Private is enabled, there is a "New list" that appears on the Public tab, but it actually just creates a Private list. I'll look at that too... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|normal |enhancement --- Comment #19 from David Cook <dcook@prosentient.com.au> --- Changing this to enhancement like bug 39374 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #20 from David Cook <dcook@prosentient.com.au> --- Created attachment 181333 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181333&action=edit Bug 39372: (follow-up) Fix toolbar and public/private selector On the lists page, it makes the "New list" link appear on the correct tab as per the sysprefs regarding Private/Public list creation. It also fixes the Public/Private "Category" dropdown menu when creating a new list, so that the options match the sysprefs. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #21 from David Cook <dcook@prosentient.com.au> --- Created attachment 181334 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181334&action=edit Bug 39372: (follow-up) Add sysprefs to controller scripts By adding the sysprefs to the controller scripts, we can prevent accidental creations or malicious creations. In theory, these error conditions shouldn't be triggered, since only the allowed actions will be displayed on the UI, but we need to cover all our bases. The error messages in opac-shelves.pl aren't currently translatable. The error handling will need some refactoring to make them translatable. However, in this particular case, it should be OK, since no one but a pen tester should bump into this message. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #22 from David Cook <dcook@prosentient.com.au> --- (In reply to Marion Durand from comment #16)
I tested your patch with ktd.
It worked well for the following combination private don't allow; public don't allow private allow; public don't allow private allow; public allow
I had a problem with the combination : private don't allow, public allow In this case, I was still able to create private lists even with the preference system on don't allow.
Could you provide a follow-up to address this issue?
Thanks again, Marion. Can you give it another go? It should be better now. Thanks! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 Marion Durand <marion.durand@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179497|0 |1 is obsolete| | Attachment #179566|0 |1 is obsolete| | Attachment #181333|0 |1 is obsolete| | Attachment #181334|0 |1 is obsolete| | --- Comment #23 from Marion Durand <marion.durand@biblibre.com> --- Created attachment 181336 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181336&action=edit Bug 39372: Limit OPAC list creation This change adds a new system preference OpacAllowPrivateListCreation, which works with the existing system preference OpacAllowPublicListCreation, to determine when "New list", "Save to lists", "Add to list", "Save to another list", and "Add to a list" should appear. If both sysprefs are disabled, then you cannot do these actions. If one of the sysprefs is enabled, then these actions appear, but are limited to the private or public list type respective to the syspref. Test plan: 0. Apply the patch and koha-plack --restart kohadev 1. Perform the following steps using differing combinations of OpacAllowPrivateListCreation, or OpacAllowPublicListCreation, or both disabled 2. Click on Lists in masthead nav and note presence of "New list" link 3. Perform a search 4. Note the presence of "Save to lists" and "Add to list" links 5. Go to a record detail page 6. Note the presence of "Save to your lists" on the sidebar 7. Create a list 8. Go to the list 9. Note the presence of "Save to another list" and "New list" links 10. Add a record to the cart 11. Note the presence of "Add to a list" link Signed-off-by: Marion Durand <marion.durand@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #24 from Marion Durand <marion.durand@biblibre.com> --- Created attachment 181337 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181337&action=edit Bug 39372: Database changes Signed-off-by: Marion Durand <marion.durand@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #25 from Marion Durand <marion.durand@biblibre.com> --- Created attachment 181338 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181338&action=edit Bug 39372: (follow-up) Fix toolbar and public/private selector On the lists page, it makes the "New list" link appear on the correct tab as per the sysprefs regarding Private/Public list creation. It also fixes the Public/Private "Category" dropdown menu when creating a new list, so that the options match the sysprefs. Signed-off-by: Marion Durand <marion.durand@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #26 from Marion Durand <marion.durand@biblibre.com> --- Created attachment 181339 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181339&action=edit Bug 39372: (follow-up) Add sysprefs to controller scripts By adding the sysprefs to the controller scripts, we can prevent accidental creations or malicious creations. In theory, these error conditions shouldn't be triggered, since only the allowed actions will be displayed on the UI, but we need to cover all our bases. The error messages in opac-shelves.pl aren't currently translatable. The error handling will need some refactoring to make them translatable. However, in this particular case, it should be OK, since no one but a pen tester should bump into this message. Signed-off-by: Marion Durand <marion.durand@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 Marion Durand <marion.durand@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=40396 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=40546 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com --- Comment #27 from Jonathan Druart <jonathan.druart@gmail.com> --- 1. We should be nicer in opac-shelves and send a "not authorized" message (search for `push @messages` in the script) 2. Wondering if we should not have a safeguard in Koha::Virtualshelf->store, just in case (there are already several checks there) Something like: if ( ! C4::Context->preference('OpacAllowPublicListCreation') && C4::Context->interface eq 'opac' && !$self->in_storage ) { Koha::Exceptions::Authorization::Unauthorized->throw } 3. Do you know exactly the context of the use case? Why would you disallow creation of private lists for users? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #28 from David Cook <dcook@prosentient.com.au> --- (In reply to Jonathan Druart from comment #27)
1. We should be nicer in opac-shelves and send a "not authorized" message (search for `push @messages` in the script)
That's how the change in opac/opac-shelves.pl works. The die is caught and then the message is added to @messages. opac/opac-addbybiblionumber.pl doesn't have @messages
2. Wondering if we should not have a safeguard in Koha::Virtualshelf->store, just in case (there are already several checks there)
Could do I guess.
Something like: if ( ! C4::Context->preference('OpacAllowPublicListCreation') && C4::Context->interface eq 'opac' && !$self->in_storage ) { Koha::Exceptions::Authorization::Unauthorized->throw }
3. Do you know exactly the context of the use case? Why would you disallow creation of private lists for users?
Yes, there are libraries in organisations like prisons/correctional centres where they don't want users to be able to input any data into the system at all. I'm sure there are probably other use cases but that's the one that brought this to my attention. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Patch doesn't apply --- Comment #29 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Hi David, patch no longer applies cleanly - can you please rebase? Apply? [(y)es, (n)o, (i)nteractive] y Applying: Bug 39372: Limit OPAC list creation Using index info to reconstruct a base tree... M koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref M koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc M koha-tmpl/opac-tmpl/bootstrap/en/includes/title-actions-menu.inc M koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt M koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt M koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt Falling back to patching base and 3-way merge... Auto-merging koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt CONFLICT (content): Merge conflict in koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt Auto-merging koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt Auto-merging koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt CONFLICT (content): Merge conflict in koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt Auto-merging koha-tmpl/opac-tmpl/bootstrap/en/includes/title-actions-menu.inc Auto-merging koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc CONFLICT (content): Merge conflict in koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc Auto-merging koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref error: Failed to merge in the changes. Patch failed at 0001 Bug 39372: Limit OPAC list creation hint: Use 'git am --show-current-patch=diff' to see the failed patch When you have resolved this problem run "git bz apply --continue". If you would prefer to skip this patch, instead run "git bz apply --skip". To restore the original branch and stop patching run "git bz apply --abort". Patch left in /tmp/Bug-39372-Limit-OPAC-list-creation-3rw97b0z.patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Patch doesn't apply |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181336|0 |1 is obsolete| | --- Comment #30 from David Cook <dcook@prosentient.com.au> --- Created attachment 193670 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193670&action=edit Bug 39372: Limit OPAC list creation This change adds a new system preference OpacAllowPrivateListCreation, which works with the existing system preference OpacAllowPublicListCreation, to determine when "New list", "Save to lists", "Add to list", "Save to another list", and "Add to a list" should appear. If both sysprefs are disabled, then you cannot do these actions. If one of the sysprefs is enabled, then these actions appear, but are limited to the private or public list type respective to the syspref. Test plan: 0. Apply the patch and koha-plack --restart kohadev 1. Perform the following steps using differing combinations of OpacAllowPrivateListCreation, or OpacAllowPublicListCreation, or both disabled 2. Click on Lists in masthead nav and note presence of "New list" link 3. Perform a search 4. Note the presence of "Save to lists" and "Add to list" links 5. Go to a record detail page 6. Note the presence of "Save to your lists" on the sidebar 7. Create a list 8. Go to the list 9. Note the presence of "Save to another list" and "New list" links 10. Add a record to the cart 11. Note the presence of "Add to a list" link -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181337|0 |1 is obsolete| | --- Comment #31 from David Cook <dcook@prosentient.com.au> --- Created attachment 193671 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193671&action=edit Bug 39372: Database changes -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181338|0 |1 is obsolete| | --- Comment #32 from David Cook <dcook@prosentient.com.au> --- Created attachment 193672 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193672&action=edit Bug 39372: (follow-up) Fix toolbar and public/private selector On the lists page, it makes the "New list" link appear on the correct tab as per the sysprefs regarding Private/Public list creation. It also fixes the Public/Private "Category" dropdown menu when creating a new list, so that the options match the sysprefs. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181339|0 |1 is obsolete| | --- Comment #33 from David Cook <dcook@prosentient.com.au> --- Created attachment 193673 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193673&action=edit Bug 39372: (follow-up) Add sysprefs to controller scripts By adding the sysprefs to the controller scripts, we can prevent accidental creations or malicious creations. In theory, these error conditions shouldn't be triggered, since only the allowed actions will be displayed on the UI, but we need to cover all our bases. The error messages in opac-shelves.pl aren't currently translatable. The error handling will need some refactoring to make them translatable. However, in this particular case, it should be OK, since no one but a pen tester should bump into this message. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #34 from David Cook <dcook@prosentient.com.au> --- Thanks for looking, Katrin. Rebased! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This change adds a system release notes| |preference | |"OpacAllowPrivateListCreati | |on" which restricts OPAC | |users from creating private | |lists. This is useful where | |you want to have librarians | |creating public lists, so | |you enable the lists | |feature, but you do not | |want OPAC users creating | |private lists. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com Status|Needs Signoff |Patch doesn't apply --- Comment #35 from David Nind <david@davidnind.com> --- The patches no longer apply 8-(.. git bz apply 39372 📋 Bug 39372 - No way to restrict OPAC users from creating private lists specifically • 193670 - Bug 39372: Limit OPAC list creation • 193671 - Bug 39372: Database changes • 193672 - Bug 39372: (follow-up) Fix toolbar and public/private selector • 193673 - Bug 39372: (follow-up) Add sysprefs to controller scripts Apply? [(y)es, (n)o, (i)nteractive] y Preparing 4 patch(es): ✓ Prepared 4 patch(es) Applying 4 patch(es): ✓ [1/4] Applied Bug 39372: Limit OPAC list creation Patch application failed for attachment 193671 - Bug 39372: Database changes -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372 --- Comment #36 from David Cook <dcook@prosentient.com.au> --- Thanks for checking, David! I'll have to have another go at rebasing them. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org