From bugzilla-daemon@bugs.koha-community.org Fri Oct 2 15:16:43 2026 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 43709] New: Cataloging: intermittent 400/403 error when switching MARC framework in the basic editor (addbiblio.pl) Date: Fri, 02 Oct 2026 15:16:40 +0000 Message-ID: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============3863426649361705265==" --===============3863426649361705265== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43709 Bug ID: 43709 Summary: Cataloging: intermittent 400/403 error when switching MARC framework in the basic editor (addbiblio.pl) Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Cataloging Assignee: koha-bugs@lists.koha-community.org Reporter: adolfo.rodriguez@xercode.es QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl Target Milestone: --- In the basic MARC editor (cataloguing/addbiblio.pl), switching the framework from the "Settings" dropdown (.change-framework links) intermittently fails with a 400 or 403 error instead of reloading the form with the new framework. The failure is frequent but not systematic. Two independent causes combine to produce this: 1. Missing e.preventDefault() on the .change-framework click handler. Changefwk() submits the form via POST, but the triggering link (href="#") is never cancelled. Depending on browser/timing, the hash navigation can race with the form submit, and the server can end up receiving a GET request instead of POST. The CSRF middleware rejects any GET request carrying op=cud-* => 400. 2. CSRF token invalidated by browser bfcache. The CSRF token (Koha::Token, see _add_default_csrf_params in Koha/Token.pm) is tied to userid + '_' + session_id. If the session changes while the page is open (session expiry followed by a new session, logout in another tab, or external session cleanup) and the browser serves the page from bfcache with the old embedded token, validation fails => 403. addbiblio.pl's Cache-Control: no-cache (without no-store) does not prevent bfcache from serving the page. Steps to reproduce (#2, the more reliably reproducible of the two): 1. Open the basic MARC editor for a record (cataloguing/addbiblio.pl) in a tab. 2. In another tab, log out, or let the session expire, or otherwise invalidate the current session (e.g. restart Plack / clear sessions table). 3. Navigate away from the editor tab and back (browser back/forward, or close and reopen via history) so it is served from bfcache with the stale CSRF token still embedded. 4. Use "Settings" > switch framework. The request fails with 403 (or the page behaves as if nothing happened, depending on how the browser renders the cached state). #1 is timing/browser-dependent and harder to force deterministically from the UI; it was identified by code audit of the click handler (.change-framework lacks preventDefault while the stays a live navigation target). Proposed fix (4 independent, complementary changes): 1. addbiblio.tt: add e.preventDefault() to the .change-framework click handler, so the href="#" navigation never competes with the POST submit. 2. addbiblio.tt: store the page's CGISESSID cookie value on load; before submitting via Changefwk(), compare it to the current cookie and reload the page instead of submitting if it changed. 3. addbiblio.tt: add a 'pageshow' listener that reloads the page when event.persisted is true (page served from bfcache), so a stale CSRF token is never submitted. 4. addbiblio.pl: pass { force_no_caching => 1 } to both output_html_with_http_headers calls, adding Cache-Control: no-store so the page is excluded from bfcache in browsers that honor it. Bug 37745 and Bug 34478 fixed earlier problems with the framework switch (duplicated CSS class, missing CSRF token), but these two issues were not caught by either. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug. --===============3863426649361705265==-- From bugzilla-daemon@bugs.koha-community.org Fri Oct 2 15:21:27 2026 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 43709] Cataloging: intermittent 400/403 error when switching MARC framework in the basic editor (addbiblio.pl) Date: Fri, 02 Oct 2026 15:21:26 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6400140991290770844==" --===============6400140991290770844== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3D43709 --- Comment #1 from Adolfo Rodr=C3=ADguez Taboada --- Created attachment 207220 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=3D207220&action= =3Dedit Cataloging: intermittent 400/403 error when switching MARC framework in the basic editor (addbiblio.pl) --=20 You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes. --===============6400140991290770844==-- From bugzilla-daemon@bugs.koha-community.org Fri Oct 2 15:21:43 2026 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 43709] Cataloging: intermittent 400/403 error when switching MARC framework in the basic editor (addbiblio.pl) Date: Fri, 02 Oct 2026 15:21:41 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============7241559857463012685==" --===============7241559857463012685== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43709 Adolfo Rodríguez Taboada changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes. --===============7241559857463012685==-- From bugzilla-daemon@bugs.koha-community.org Sun Oct 4 07:53:38 2026 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 43709] Cataloging: intermittent 400/403 error when switching MARC framework in the basic editor (addbiblio.pl) Date: Sun, 04 Oct 2026 07:53:34 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6352719407718086497==" --===============6352719407718086497== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43709 Jonathan Druart changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com Status|Needs Signoff |Failed QA --- Comment #2 from Jonathan Druart --- I have not tried to recreate the problem but I do understand the issue you describe. However there are a couple of things that are not correct: 1. Cookies.get("CGISESSID") is always undefined (we have it httpOnly) 2. The force_no_caching will cause problem for catalogers when using the browser's back button Could you try with only the preventDefault change? It feels like it should be enough to fix the problem. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes. --===============6352719407718086497==-- From bugzilla-daemon@bugs.koha-community.org Tue Oct 13 15:17:19 2026 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 43709] Cataloging: intermittent 400/403 error when switching MARC framework in the basic editor (addbiblio.pl) Date: Tue, 13 Oct 2026 15:17:16 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============4617648797418998737==" --===============4617648797418998737== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3D43709 Adolfo Rodr=C3=ADguez Taboada changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #207220|0 |1 is obsolete| | --- Comment #3 from Adolfo Rodr=C3=ADguez Taboada --- Created attachment 207867 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=3D207867&action= =3Dedit Cataloging: intermittent 400/403 error when switching MARC framework in the basic editor (addbiblio.pl) --=20 You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug. --===============4617648797418998737==-- From bugzilla-daemon@bugs.koha-community.org Tue Oct 13 15:18:06 2026 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 43709] Cataloging: intermittent 400/403 error when switching MARC framework in the basic editor (addbiblio.pl) Date: Tue, 13 Oct 2026 15:18:04 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0754590308032260685==" --===============0754590308032260685== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3D43709 Adolfo Rodr=C3=ADguez Taboada changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff --- Comment #4 from Adolfo Rodr=C3=ADguez Taboada --- You're right on both counts =E2=80=94 I have verified against the code: 1 CGISESSID is created with -HttpOnly =3D> 1 everywhere it's set in C4/Auth.p= m (9 occurrences), so Cookies.get() could never read it. That check was dead code from the start. 2 force_no_caching adds Cache-Control: no-store (C4/Output.pm), which excludes the page from bfcache =E2=80=94 that does break the normal back-button workfl= ow catalogers rely on after saving. v2 (attached, obsoletes 207220) keeps only the preventDefault() fix and drops the other three changes entirely, including reverting addbiblio.pl back to its unmodified state. One caveat worth being upfront about: the original 400 error (missing preventDefault racing the GET vs POST) was only ever observed in a production environment =E2=80=94 it's timing-dependent and we were not able to reproduce= it reliably on demand in a dev/KTD setup. So this v2 hasn't been locally tested against the actual failure, only confirmed to not regress normal framework-switching. Given the mechanism is well understood (an uncancelled href=3D"#" racing a form submit()), I'm fairly confident in the fix, but flag= ging this since it changes what "tested" means here. The second root cause from the original description (stale CSRF token after session change + bfcache restore) is still unaddressed by this patch. It's a narrower, rarer edge case; I'll consider filing it separately with a less invasive approach (gracefully handling the 403) rather than bundling it here. --=20 You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug. --===============0754590308032260685==--