https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 --- Comment #1 from Olli-Antti Kivilahti <olli-antti.kivilahti@hypernova.fi> --- Created attachment 170761 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=170761&action=edit Bug 37692 - Self-registration verification cannot be done if OPACPublic is not allowed Registering new accounts need to be done even though OPAC requires login. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 SamSowanick <sam.sowanick@corvallisoregon.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sam.sowanick@corvallisorego | |n.gov --- Comment #2 from SamSowanick <sam.sowanick@corvallisoregon.gov> --- Can you please include a test / sign off plan. Sam. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 Fiona Borthwick <fiona.borthwick@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fiona.borthwick@ptfs-europe | |.com Status|Needs Signoff |Failed QA --- Comment #4 from Fiona Borthwick <fiona.borthwick@ptfs-europe.com> --- Failing QA due to missing test plan -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 --- Comment #6 from Olli-Antti Kivilahti <olli-antti.kivilahti@hypernova.fi> --- The real question is, is this something that should be done, in this way, from a security-perspective? Obviously something needs to be done since the OPACSelfRegistration-feature doesnt work without this. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 Lari Taskula <lari.taskula@hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |35445 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35445 [Bug 35445] OPAC registration verification triggered by email URL scanners -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 --- Comment #9 from Lari Taskula <lari.taskula@hypernova.fi> --- (In reply to Olli-Antti Kivilahti from comment #6)

The real question is, is this something that should be done, in this way, from a security-perspective? Obviously something needs to be done since the OPACSelfRegistration-feature doesnt work without this.

This page is protected by system preference "PatronSelfRegistration". In case it is disabled, the user is redirected to opac-main and from there to the login screen. The user is also redirected to the login screen if they present an invalid verification token. So a valid verification token is needed in order to temporarily bypass a disabled OpacPublic setting. Additionally, C4::Auth::checkauth has in the past accepted bypassing OpacPublic for this particular view. See https://github.com/Koha-Community/Koha/blob/6744b12d3ab4d9e33b22076c0e43b320... So I think your patch is okay. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37692 Lari Taskula <lari.taskula@hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #170761|0 |1 is obsolete| | --- Comment #10 from Lari Taskula <lari.taskula@hypernova.fi> --- Created attachment 191422 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=191422&action=edit Bug 37692: Self-registration verification cannot be done if OPACPublic is not allowed Registering new accounts need to be done even though OPAC requires login. To test: Set the following system preferences -1. Set PatronSelfRegistration to 'Allow' -2. Set PatronSelfRegistrationVerifyByEmail to 'Require' -3. Set OpacPublic to 'Disable' Before applying the patch, 1. Navigate to OPAC 2. Observe login screen is presented 3. Observe "Create an account" is present 4. Click "Create an account" 5. Fill in mandatory fields 6. Click "Submit" button 7. Grab your verification token from the database by using the following query: SELECT verification_token FROM borrower_modifications; 8. Go to /cgi-bin/koha/opac-registration-verify.pl?token=XXX where XXX is the verification_token 9. Observe login screen is presented and self-registration verification is still pending After applying the patch, the last step should be: 9. Observe "Registration pending", "Click the button below to confirm registration." 10. Click "Confirm" button 11. Observe "Registration complete!", "You have successfully registered your new account." -- You are receiving this mail because: You are watching all bug changes.