[Bug 37914] New: Forms for budget planning filters and export should GET rather than POST
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37914 Bug ID: 37914 Summary: Forms for budget planning filters and export should GET rather than POST Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P3 Component: Acquisitions Assignee: phil@chetcolibrary.org Reporter: phil@chetcolibrary.org QA Contact: testopia@bugs.koha-community.org Depends on: 36192 Blocks: 37728 Because of the bug 36192 CSRF protection, we intend not to have forms that POST without a param named 'op' with a value starting with 'cud-'. Because of bug 37728, a few were missed, including the 'Filters' form that lets you switch between planning budgets by month or by itemtype or by library, and the 'Export' form that lets you save your planning as a .csv file. Neither one has any need to POST, they can just be the GET they naturally are. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37728 [Bug 37728] More "op" are missing in POSTed forms -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37914 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37914 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37914 --- Comment #1 from Phil Ringnalda <phil@chetcolibrary.org> --- Created attachment 171431 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=171431&action=edit Bug 37914: Forms for budget planning filters and export should GET rather than POST Because of the bug 36192 CSRF protection, we intend not to have forms that POST without a param named 'op' with a value starting with 'cud-'. Because of bug 37728, a few were missed, including the 'Filters' form that lets you switch between planning budgets by month or by itemtype or by library, and the 'Export' form that lets you save your planning as a .csv file. Neither one has any need to POST, they can just be the GET they naturally are. Alas, the default data won't let you exercise everything, so there's a lot of setup before the actual testing. Test plan: 1. Patrons - search for Acevedo - More-> Set permissions - check Acquisitions management and Save 2. Administration - Authorized values - Asort1 - New authorized value for Asort1 - value Q1, description First Quarter, then repeat for Q2, Q3, Q4 3. Administration - Budgets - New budget - give it a start date of today, end date of a year from today, a description, a total amount of 100000.00, for Statistic 1 done on choose Asort1 4. Click the name of your new budget - New-> New fund for (name) - give it the code my, name My money, amount 75000.00 and Submit 5. New-> New fund for (name) - give it the code his, name Henry's money, amount 25000.00, and click Select owner, find Henry and Select, then Submit 6. Acquisitions - click Search on an empty search box to find the only vendor - New-> Basket - Give it a name and Save 7. Add to basket - From an existing record (search for something like Perl) click any bib record - Add order - set the required item type and click Add item 8. Scroll down to the Accounting details form, change Fund to My money, and enter 20.00 for the Vendor price and click Save. You just made that fund "active" in the eyes of the Filter form, by spending some of it. 9. Finally set up. Administration - Budgets - click the name of your budget 10. Planning-> Plan by months 11. In the upper left Filter box, check Show my funds only and Submit - you should see Henry's money disappear 12. Uncheck Show my funds only and check Show active funds only and Submit - you should see Henry's money disappear 13. Check Show actual/estimated values and Submit, you should see text for the actual (only in this month, since that's all you spent) and wee little shrunken text boxes for the planning numbers 14. Uncheck all the boxes and change the dropdown from by months to by Asort1 (either one of it, there being two is bug 34159) and Submit, you should have four columns for Q1 - Q4 and only for My money, since Henry doesn't use Asort1 15. Click the Auto-fill row button, and Save 16. In the Export form (which isn't much of a form, since you only have a choice for the filename) click Submit 17. You should have downloaded a .csv file, and if you open it it should have the info from your current planning form. 18. Apply patch, restart_all 19. Repeat steps 9-17, getting the same results you did without the patch Sponsored-by: Chetco Community Public Library -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37914 --- Comment #2 from Phil Ringnalda <phil@chetcolibrary.org> --- One drive-by change in there, but it was intentional: the Filters form had <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" /> twice, once as the second line of the form and again as the second to last line. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37914 Sukhmandeep <sukhmandeep.benipal@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #171431|0 |1 is obsolete| | --- Comment #3 from Sukhmandeep <sukhmandeep.benipal@inLibro.com> --- Created attachment 171487 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=171487&action=edit Bug 37914: Forms for budget planning filters and export should GET rather than POST Because of the bug 36192 CSRF protection, we intend not to have forms that POST without a param named 'op' with a value starting with 'cud-'. Because of bug 37728, a few were missed, including the 'Filters' form that lets you switch between planning budgets by month or by itemtype or by library, and the 'Export' form that lets you save your planning as a .csv file. Neither one has any need to POST, they can just be the GET they naturally are. Alas, the default data won't let you exercise everything, so there's a lot of setup before the actual testing. Test plan: 1. Patrons - search for Acevedo - More-> Set permissions - check Acquisitions management and Save 2. Administration - Authorized values - Asort1 - New authorized value for Asort1 - value Q1, description First Quarter, then repeat for Q2, Q3, Q4 3. Administration - Budgets - New budget - give it a start date of today, end date of a year from today, a description, a total amount of 100000.00, for Statistic 1 done on choose Asort1 4. Click the name of your new budget - New-> New fund for (name) - give it the code my, name My money, amount 75000.00 and Submit 5. New-> New fund for (name) - give it the code his, name Henry's money, amount 25000.00, and click Select owner, find Henry and Select, then Submit 6. Acquisitions - click Search on an empty search box to find the only vendor - New-> Basket - Give it a name and Save 7. Add to basket - From an existing record (search for something like Perl) click any bib record - Add order - set the required item type and click Add item 8. Scroll down to the Accounting details form, change Fund to My money, and enter 20.00 for the Vendor price and click Save. You just made that fund "active" in the eyes of the Filter form, by spending some of it. 9. Finally set up. Administration - Budgets - click the name of your budget 10. Planning-> Plan by months 11. In the upper left Filter box, check Show my funds only and Submit - you should see Henry's money disappear 12. Uncheck Show my funds only and check Show active funds only and Submit - you should see Henry's money disappear 13. Check Show actual/estimated values and Submit, you should see text for the actual (only in this month, since that's all you spent) and wee little shrunken text boxes for the planning numbers 14. Uncheck all the boxes and change the dropdown from by months to by Asort1 (either one of it, there being two is bug 34159) and Submit, you should have four columns for Q1 - Q4 and only for My money, since Henry doesn't use Asort1 15. Click the Auto-fill row button, and Save 16. In the Export form (which isn't much of a form, since you only have a choice for the filename) click Submit 17. You should have downloaded a .csv file, and if you open it it should have the info from your current planning form. 18. Apply patch, restart_all 19. Repeat steps 9-17, getting the same results you did without the patch Sponsored-by: Chetco Community Public Library Signed-off-by: Sukhmandeep Benipal <sukhmandeep.benipal@inLibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37914 Sukhmandeep <sukhmandeep.benipal@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sukhmandeep.benipal@inLibro | |.com Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37914 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37914 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #171487|0 |1 is obsolete| | --- Comment #4 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 171545 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=171545&action=edit Bug 37914: Forms for budget planning filters and export should GET rather than POST Because of the bug 36192 CSRF protection, we intend not to have forms that POST without a param named 'op' with a value starting with 'cud-'. Because of bug 37728, a few were missed, including the 'Filters' form that lets you switch between planning budgets by month or by itemtype or by library, and the 'Export' form that lets you save your planning as a .csv file. Neither one has any need to POST, they can just be the GET they naturally are. Alas, the default data won't let you exercise everything, so there's a lot of setup before the actual testing. Test plan: 1. Patrons - search for Acevedo - More-> Set permissions - check Acquisitions management and Save 2. Administration - Authorized values - Asort1 - New authorized value for Asort1 - value Q1, description First Quarter, then repeat for Q2, Q3, Q4 3. Administration - Budgets - New budget - give it a start date of today, end date of a year from today, a description, a total amount of 100000.00, for Statistic 1 done on choose Asort1 4. Click the name of your new budget - New-> New fund for (name) - give it the code my, name My money, amount 75000.00 and Submit 5. New-> New fund for (name) - give it the code his, name Henry's money, amount 25000.00, and click Select owner, find Henry and Select, then Submit 6. Acquisitions - click Search on an empty search box to find the only vendor - New-> Basket - Give it a name and Save 7. Add to basket - From an existing record (search for something like Perl) click any bib record - Add order - set the required item type and click Add item 8. Scroll down to the Accounting details form, change Fund to My money, and enter 20.00 for the Vendor price and click Save. You just made that fund "active" in the eyes of the Filter form, by spending some of it. 9. Finally set up. Administration - Budgets - click the name of your budget 10. Planning-> Plan by months 11. In the upper left Filter box, check Show my funds only and Submit - you should see Henry's money disappear 12. Uncheck Show my funds only and check Show active funds only and Submit - you should see Henry's money disappear 13. Check Show actual/estimated values and Submit, you should see text for the actual (only in this month, since that's all you spent) and wee little shrunken text boxes for the planning numbers 14. Uncheck all the boxes and change the dropdown from by months to by Asort1 (either one of it, there being two is bug 34159) and Submit, you should have four columns for Q1 - Q4 and only for My money, since Henry doesn't use Asort1 15. Click the Auto-fill row button, and Save 16. In the Export form (which isn't much of a form, since you only have a choice for the filename) click Submit 17. You should have downloaded a .csv file, and if you open it it should have the info from your current planning form. 18. Apply patch, restart_all 19. Repeat steps 9-17, getting the same results you did without the patch Sponsored-by: Chetco Community Public Library Signed-off-by: Sukhmandeep Benipal <sukhmandeep.benipal@inLibro.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37914 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |jonathan.druart@gmail.com |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37914 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |24.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37914 --- Comment #5 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.11! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37914 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|24.11.00 |24.11.00,24.05.06 released in| | Status|Pushed to main |Pushed to stable --- Comment #6 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.06 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37914 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37914 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Status|Pushed to oldstable |Needs documenting --- Comment #7 from Fridolin Somers <fridolin.somers@biblibre.com> --- Not for 23.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37914 Aude Charillon <aude.charillon@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |aude.charillon@ptfs-europe. | |com Status|Needs documenting |RESOLVED Resolution|--- |FIXED --- Comment #8 from Aude Charillon <aude.charillon@ptfs-europe.com> --- No need for update to Koha Manual. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37914 Bug 37914 depends on bug 36192, which changed state. Bug 36192 Summary: [OMNIBUS] CSRF Protection for Koha https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon@bugs.koha-community.org