https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33260
--- Comment #425 from Martin Renvoize (ashimema) <[email protected]> --- I have rebased the patchset on current main (it no longer applied: bug 10190 changed the tools menu and permissions), carrying the existing sign-offs over, and added three QA follow-ups on top (the last three attachments), after a QA review of the whole series. The new follow-ups need sign-off. What the follow-ups fix: * Privacy: members/print_notice.pl looked messages up by id with no check, so a staff member limited to some libraries' patrons could print any patron's notice by guessing an id, and an unknown id gave a 500. It now uses search_limited, ignores unknown/unauthorised/non-numeric ids and honours NoticesManagement. * Printing no longer changes anything on a GET: marking as sent needs a POST with a CSRF token and op=cud-print, from the row, modal and bulk Print buttons alike (so the modal Print now also matches the "printing marks it as sent" banner). * Notice content in the lists and modal preview is shown in sandboxed frames, so nothing in a notice runs in the staff session. * Koha::Notice::Messages->search_limited: no longer modifies its arguments, ANDs the library restriction with the caller's library filter instead of replacing it, returns nothing if the logged in patron can't be found. * Koha::Notice::Message->scoped_style produced broken CSS (the scope landed inside declarations with more than one rule, @media content was lost); replaced with a small CSS scoper, also used for the per-template styles. * tools/notices.pl: stop after the preference redirect, inclusive "To" date, most recent 1000 results with a message when there are more. * Templates: the status filter always selected "sent", wrong default sort and visible frames on the patron tab, NoSort -> no-sort, tools page missing the Koha plugin (empty CSP nonce), print/resend controls only for staff who can use them. * members/notices.pl: resend compared the patron with an assignment, so any message id could be resent from any patron's page. * Tests: Letters.t and Message.t plans, search_limited test updated for Bug 20133 (library groups need ft_hide_patron_info) and extended, scoped_style tests; file modes, newlines, tidy, POD. Not addressed here, for follow-up bugs: HTML notice content is still printed raw in the print page (same as slips; the real fix is escaping substituted values in C4::Letters), printing sets any status to "sent" as agreed earlier in the thread, and the removal of members/printnotice.pl may deserve a release note. I tested it in KTD, including with a staff user restricted to one library group who has only the view_generated_notices permission. koha-qa passes, apart from a git_manipulation warning for tools/print_notice.pl, which an earlier patch adds and a later one moves. Setting back to Needs Signoff for the new follow-ups. -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
