[Bug 37692] New: Self-registration verification cannot be done if OPACPublic is not allowed
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 Bug ID: 37692 Summary: Self-registration verification cannot be done if OPACPublic is not allowed Change sponsored?: --- Product: Koha Version: 24.05 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard@myacpl.org Reporter: olli-antti.kivilahti@hypernova.fi QA Contact: testopia@bugs.koha-community.org User needs to be logged in to verify his pending account creation. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 --- Comment #1 from Olli-Antti Kivilahti <olli-antti.kivilahti@hypernova.fi> --- Created attachment 170761 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=170761&action=edit Bug 37692 - Self-registration verification cannot be done if OPACPublic is not allowed Registering new accounts need to be done even though OPAC requires login. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 Olli-Antti Kivilahti <olli-antti.kivilahti@hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 SamSowanick <sam.sowanick@corvallisoregon.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sam.sowanick@corvallisorego | |n.gov --- Comment #2 from SamSowanick <sam.sowanick@corvallisoregon.gov> --- Can you please include a test / sign off plan. Sam. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|oleonard@myacpl.org |olli-antti.kivilahti@hypern | |ova.fi CC| |david@davidnind.com --- Comment #3 from David Nind <david@davidnind.com> --- I changed the assignee. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 Fiona Borthwick <fiona.borthwick@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fiona.borthwick@ptfs-europe | |.com Status|Needs Signoff |Failed QA --- Comment #4 from Fiona Borthwick <fiona.borthwick@ptfs-europe.com> --- Failing QA due to missing test plan -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 --- Comment #5 from Olli-Antti Kivilahti <olli-antti.kivilahti@hypernova.fi> --- Test plan: 1. Set syspref OPACPublic to "not-public" 2. OPAC Self-registration verification link is not accessible for users not-logged-in -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 --- Comment #6 from Olli-Antti Kivilahti <olli-antti.kivilahti@hypernova.fi> --- The real question is, is this something that should be done, in this way, from a security-perspective? Obviously something needs to be done since the OPACSelfRegistration-feature doesnt work without this. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 Lari Taskula <lari.taskula@hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lari.taskula@hypernova.fi Status|Failed QA |In Discussion --- Comment #7 from Lari Taskula <lari.taskula@hypernova.fi> --- (In reply to Olli-Antti Kivilahti from comment #6)
The real question is, is this something that should be done, in this way, from a security-perspective? Obviously something needs to be done since the OPACSelfRegistration-feature doesnt work without this.
Based on this comment, setting status to In Discussion. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 Lari Taskula <lari.taskula@hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |35445 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 [Bug 35445] OPAC registration verification triggered by email URL scanners -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 --- Comment #8 from Lari Taskula <lari.taskula@hypernova.fi> --- To reproduce: Set the following system preferences -1. Set PatronSelfRegistration to 'Allow' -2. Set PatronSelfRegistrationVerifyByEmail to 'Require' -3. Set OpacPublic to 'Disable' 1. Navigate to OPAC 2. Observe login screen is presented 3. Observe "Create an account" is present 4. Click "Create an account" 5. Fill in mandatory fields 6. Click "Submit" button 7. Grab your verification token from the database by using the following query: SELECT verification_token FROM borrower_modifications; 8. Go to /cgi-bin/koha/opac-registration-verify.pl?token=XXX where XXX is the verification_token 9. Observe login screen is presented and self-registration verification is still pending The last step should instead be: 9. Observe "Registration pending", "Click the button below to confirm registration." 10. Click "Confirm" button 11. Observe "Registration complete!", "You have successfully registered your new account." -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 --- Comment #9 from Lari Taskula <lari.taskula@hypernova.fi> --- (In reply to Olli-Antti Kivilahti from comment #6)
The real question is, is this something that should be done, in this way, from a security-perspective? Obviously something needs to be done since the OPACSelfRegistration-feature doesnt work without this.
This page is protected by system preference "PatronSelfRegistration". In case it is disabled, the user is redirected to opac-main and from there to the login screen. The user is also redirected to the login screen if they present an invalid verification token. So a valid verification token is needed in order to temporarily bypass a disabled OpacPublic setting. Additionally, C4::Auth::checkauth has in the past accepted bypassing OpacPublic for this particular view. See https://github.com/Koha-Community/Koha/blob/6744b12d3ab4d9e33b22076c0e43b320... So I think your patch is okay. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 Lari Taskula <lari.taskula@hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|In Discussion |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 Lari Taskula <lari.taskula@hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #170761|0 |1 is obsolete| | --- Comment #10 from Lari Taskula <lari.taskula@hypernova.fi> --- Created attachment 191422 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=191422&action=edit Bug 37692: Self-registration verification cannot be done if OPACPublic is not allowed Registering new accounts need to be done even though OPAC requires login. To test: Set the following system preferences -1. Set PatronSelfRegistration to 'Allow' -2. Set PatronSelfRegistrationVerifyByEmail to 'Require' -3. Set OpacPublic to 'Disable' Before applying the patch, 1. Navigate to OPAC 2. Observe login screen is presented 3. Observe "Create an account" is present 4. Click "Create an account" 5. Fill in mandatory fields 6. Click "Submit" button 7. Grab your verification token from the database by using the following query: SELECT verification_token FROM borrower_modifications; 8. Go to /cgi-bin/koha/opac-registration-verify.pl?token=XXX where XXX is the verification_token 9. Observe login screen is presented and self-registration verification is still pending After applying the patch, the last step should be: 9. Observe "Registration pending", "Click the button below to confirm registration." 10. Click "Confirm" button 11. Observe "Registration complete!", "You have successfully registered your new account." -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 --- Comment #11 from Lari Taskula <lari.taskula@hypernova.fi> --- Comment on attachment 170761 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=170761 Bug 37692 - Self-registration verification cannot be done if OPACPublic is not allowed Review of attachment 170761: --> (https://bugs.koha-community.org/bugzilla3/page.cgi?id=splinter.html&bug=37692&attachment=170761) ----------------------------------------------------------------- I have tidied the patch, fixed the commit message, added a test plan, and removed the last authnotrequired as your change had no effect on it. ::: opac/opac-registration-verify.pl @@ +173,4 @@
template_name => "opac-registration-invalid.tt", type => "opac", query => $cgi, + authnotrequired => 1,
This last authnotrequired has no effect no matter the setting. The user will always be redirected to the login screen. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy@rijksmuseum.nl --- Comment #12 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- *** Bug 39366 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 --- Comment #13 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Before this patch this depends on OpacPublic, with this patch, the patch will never require authentication. I wonder if there could be a benefit in making it dependent on PatronSelfRegistrationVerifyByEmail as the duplicate bug 39366 pointed out? This way we would only make the page available when the feature it is required for is in use. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 --- Comment #14 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- - authnotrequired => C4::Context->preference("OpacPublic") ? 1 : 0, To - authnotrequired => C4::Context->preference("PatronSelfRegistrationVerifyByEmail") ? 1 : 0, ? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|24.05 |Main Severity|enhancement |minor -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA --- Comment #15 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Needs feedback -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org