https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43709 Bug ID: 43709 Summary: Cataloging: intermittent 400/403 error when switching MARC framework in the basic editor (addbiblio.pl) Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Cataloging Assignee: koha-bugs@lists.koha-community.org Reporter: adolfo.rodriguez@xercode.es QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl Target Milestone: --- In the basic MARC editor (cataloguing/addbiblio.pl), switching the framework from the "Settings" dropdown (.change-framework links) intermittently fails with a 400 or 403 error instead of reloading the form with the new framework. The failure is frequent but not systematic. Two independent causes combine to produce this: 1. Missing e.preventDefault() on the .change-framework click handler. Changefwk() submits the form via POST, but the triggering link (href="#") is never cancelled. Depending on browser/timing, the hash navigation can race with the form submit, and the server can end up receiving a GET request instead of POST. The CSRF middleware rejects any GET request carrying op=cud-* => 400. 2. CSRF token invalidated by browser bfcache. The CSRF token (Koha::Token, see _add_default_csrf_params in Koha/Token.pm) is tied to userid + '_' + session_id. If the session changes while the page is open (session expiry followed by a new session, logout in another tab, or external session cleanup) and the browser serves the page from bfcache with the old embedded token, validation fails => 403. addbiblio.pl's Cache-Control: no-cache (without no-store) does not prevent bfcache from serving the page. Steps to reproduce (#2, the more reliably reproducible of the two): 1. Open the basic MARC editor for a record (cataloguing/addbiblio.pl) in a tab. 2. In another tab, log out, or let the session expire, or otherwise invalidate the current session (e.g. restart Plack / clear sessions table). 3. Navigate away from the editor tab and back (browser back/forward, or close and reopen via history) so it is served from bfcache with the stale CSRF token still embedded. 4. Use "Settings" > switch framework. The request fails with 403 (or the page behaves as if nothing happened, depending on how the browser renders the cached state). #1 is timing/browser-dependent and harder to force deterministically from the UI; it was identified by code audit of the click handler (.change-framework lacks preventDefault while the <a href="#"> stays a live navigation target). Proposed fix (4 independent, complementary changes): 1. addbiblio.tt: add e.preventDefault() to the .change-framework click handler, so the href="#" navigation never competes with the POST submit. 2. addbiblio.tt: store the page's CGISESSID cookie value on load; before submitting via Changefwk(), compare it to the current cookie and reload the page instead of submitting if it changed. 3. addbiblio.tt: add a 'pageshow' listener that reloads the page when event.persisted is true (page served from bfcache), so a stale CSRF token is never submitted. 4. addbiblio.pl: pass { force_no_caching => 1 } to both output_html_with_http_headers calls, adding Cache-Control: no-store so the page is excluded from bfcache in browsers that honor it. Bug 37745 and Bug 34478 fixed earlier problems with the framework switch (duplicated CSS class, missing CSRF token), but these two issues were not caught by either. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.