https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33260
--- Comment #490 from Martin Renvoize (ashimema) <[email protected]> --- Created attachment 209329 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=209329&action=edit Bug 33260: (QA follow-up) Do not display or print notices that contain secrets tools.view_generated_notices is a lower permission than the one that was needed to read the content of notices of a patron, and the notices include those that carry a secret: a password reset link (even a staff member's) or a security code. Anyone who could use the notices pages could read them. Notices that can carry a secret, those with the letter codes PASSWORD_RESET, STAFF_PASSWORD_RESET, OPAC_REG_VERIFY and 2FA_OTP_TOKEN, are still listed, with their status and the other details, so there is a record that they were sent, but: * their content is replaced by a message saying why in the lists, the preview and everywhere Koha::Notice::Message->html_content is used, * they cannot be printed (Koha::Notice::Message->can_be_printed), also from print_notice.pl. To test: 1. Run the unit tests inside KTD: ktd --shell --run 'prove t/db_dependent/Koha/Notice/Message.t' 2. Enable NoticesManagement and send a password reset to a patron, from the patron's page "More > Send password reset", or from the OPAC. 3. In Tools > Notices management and on the patron's Notices tab, open the password reset notice: its status is shown but not its content, and it cannot be selected or printed. 4. Other notices are still displayed and can be printed. 5. Sign off Co-Authored-By: Claude Sonnet 5.5 <[email protected]> -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
