[Bug 39055] New: Unauthenticated are not redirected properly in reports module after login
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Bug ID: 39055 Summary: Unauthenticated are not redirected properly in reports module after login Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Staff interface Assignee: koha-bugs@lists.koha-community.org Reporter: lucas@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com This seems to be a recent change in behavior. To reproduce: 1. Find/create a report, run it and copy the URL. Something like "http://localhost:8081/cgi-bin/koha/reports/guided_reports.pl?id=1&op=run" 2. Logout, or use a private browsing tab, and use the URL from above. 3. You'll be promoted to login fist, do that. 4. Once you are logged in you'll be taken to the reports home page instead of your specific report. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Laura O'Neil <laura@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |laura@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Laura O'Neil <laura@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sspohn@oslri.net -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Steve, OSLRI, USA <sspohn@oslri.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |bywater@oslri.net -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #1 from Steve, OSLRI, USA <sspohn@oslri.net> --- I'll just add that I do see the report id in the login form in a hidden field, so it does carry to the login form, but gets lost after login. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |phil@chetcolibrary.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |blawlor@clamsnet.org --- Comment #2 from Brendan Lawlor <blawlor@clamsnet.org> --- I found that when using a local login, after authentication the op param is updated to cud-login. After authentication the id param is not in the url, but it is included in the payload. The report doesn't load because the op param is not longer 'run' Interestingly after an SSO authentication the page loads with the complete original url and the report loads -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #3 from Steve, OSLRI, USA <sspohn@oslri.net> --- Confirming that we see that it works via SSO here as well. Seems to be limited to local login. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Marion Durand <marion.durand@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |marion.durand@biblibre.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au, | |jonathan.druart@gmail.com --- Comment #4 from Jonathan Druart <jonathan.druart@gmail.com> --- Owen reported the same problem on suggestion/suggestion.pl I am stuck here, what I am trying to do won't work as we don't sent back the modified CGI object to the controller. Any ideas, David? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #5 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 191568 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=191568&action=edit Bug 39055: wip Patch from commit 1c381a0 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #6 from David Cook <dcook@prosentient.com.au> --- (In reply to Jonathan Druart from comment #4)
Owen reported the same problem on suggestion/suggestion.pl
I am stuck here, what I am trying to do won't work as we don't sent back the modified CGI object to the controller.
Any ideas, David?
Yeah, that's an interesting one. A lot of other apps have /login* endpoints which may or may not redirect back to a sanitized referrer. That would be easy to handle. But Koha has always allowed login on any page, which has its pros and cons... The simplest option would probably be change the login not to use the "op" parameter. We could change it to "login_op". We would need to update Koha/Middleware/CSRF.pm to handle this special case because a login POST could contain an "op" without a "cud-" prefix. Alternatively, we could try to hack the inputs to stuff the query string params back in via a Plack::Middleware or through C4/Auth.pm but I don't like that idea as it's dirty/hacky. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #7 from David Cook <dcook@prosentient.com.au> --- Created attachment 191617 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=191617&action=edit Bug 39055: Change "op" to "login_op" when logging in to allow original op to flow through This patch changes "op" to "login_op" when logging in, so that the original op can flow through to whichever controller is processing the login and subsequent op. Test plan: 0. apply the patch and koha-plack --restart kohadev 1. Without logging in, go to the following: http://localhost:8081/cgi-bin/koha/reports/guided_reports.pl?id=1&op=run 2. Log in and note that you can see the report 3. Try logging into the OPAC 4. Try logging into the self-checkout 5. Create a new self-reg account and try logging in with the auto-filled details 6. Test anything else you can think to test here -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |In Discussion -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #8 from David Cook <dcook@prosentient.com.au> --- I've done a patch for my "login_op" idea and it seems to work pretty well. It's the only practical idea I've got at the moment I think. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|In Discussion |Needs Signoff Assignee|koha-bugs@lists.koha-commun |dcook@prosentient.com.au |ity.org | --- Comment #9 from Jonathan Druart <jonathan.druart@gmail.com> --- Yes I agree with the solution, ready for signoff. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |jonathan.druart@gmail.com |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #191568|0 |1 is obsolete| | Attachment #191617|0 |1 is obsolete| | --- Comment #10 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 192121 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=192121&action=edit Bug 39055: Change "op" to "login_op" when logging in to allow original op to flow through This patch changes "op" to "login_op" when logging in, so that the original op can flow through to whichever controller is processing the login and subsequent op. Test plan: 0. apply the patch and koha-plack --restart kohadev 1. Without logging in, go to the following: http://localhost:8081/cgi-bin/koha/reports/guided_reports.pl?id=1&op=run 2. Log in and note that you can see the report 3. Try logging into the OPAC 4. Try logging into the self-checkout 5. Create a new self-reg account and try logging in with the auto-filled details 6. Test anything else you can think to test here Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #11 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 192308 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=192308&action=edit Bug 39055: Fix mojo/acquisition/vendors.t Patch from commit 2c5d7b3 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #12 from Jonathan Druart <jonathan.druart@gmail.com> --- t/db_dependent/mojo/csrf.t is failing Shouldn't we add a case in the middleware to force login_op to be POSTed? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #13 from David Cook <dcook@prosentient.com.au> --- (In reply to Jonathan Druart from comment #12)
Shouldn't we add a case in the middleware to force login_op to be POSTed?
Yeah, that's probably true. I think there are fail safes in C4/Auth.pm but yeah good point. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #192121|0 |1 is obsolete| | --- Comment #14 from David Cook <dcook@prosentient.com.au> --- Created attachment 192350 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=192350&action=edit Bug 39055: Change "op" to "login_op" when logging in to allow original op to flow through This patch changes "op" to "login_op" when logging in, so that the original op can flow through to whichever controller is processing the login and subsequent op. Test plan: 0. apply the patch and koha-plack --restart kohadev 1. Without logging in, go to the following: http://localhost:8081/cgi-bin/koha/reports/guided_reports.pl?id=1&op=run 2. Log in and note that you can see the report 3. Try logging into the OPAC 4. Try logging into the self-checkout 5. Create a new self-reg account and try logging in with the auto-filled details 6. Test anything else you can think to test here Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #192308|0 |1 is obsolete| | --- Comment #15 from David Cook <dcook@prosentient.com.au> --- Created attachment 192351 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=192351&action=edit Bug 39055: Fix mojo/acquisition/vendors.t Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #16 from David Cook <dcook@prosentient.com.au> --- Created attachment 192352 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=192352&action=edit Bug 39055: Add more login_op checks to middleware Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #17 from David Cook <dcook@prosentient.com.au> --- Created attachment 192353 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=192353&action=edit Bug 39055: Add change to Koha::App::Plugin::CSRF and fix unit test Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA --- Comment #18 from David Cook <dcook@prosentient.com.au> --- I forgot to test it properly and it broke... and I'm now in the middle of other things. I'll come back to this... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #19 from David Cook <dcook@prosentient.com.au> --- Created attachment 192354 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=192354&action=edit Bug 39055: Fix login condition when using op and login_op -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com Status|Needs Signoff |Patch doesn't apply --- Comment #20 from David Nind <david@davidnind.com> --- Patches no longer apply 8-(... /kohadevbox/perl-git-bz/bin/git-bz apply 39055 📋 Bug 39055 - Unauthenticated are not redirected properly in reports module after login • 192350 - Bug 39055: Change "op" to "login_op" when logging in to allow original op to flow through • 192351 - Bug 39055: Fix mojo/acquisition/vendors.t • 192352 - Bug 39055: Add more login_op checks to middleware • 192353 - Bug 39055: Add change to Koha::App::Plugin::CSRF and fix unit test • 192354 - Bug 39055: Fix login condition when using op and login_op Apply? [(y)es, (n)o, (i)nteractive] y Preparing 5 patch(es): ✓ Prepared 5 patch(es) Applying 5 patch(es): ✓ [1/5] Applied Bug 39055: Change "op" to "login_op" when logging in to allow… ✓ [2/5] Applied Bug 39055: Fix mojo/acquisition/vendors.t ✓ [3/5] Applied Bug 39055: Add more login_op checks to middleware Patch application failed for attachment 192353 - Bug 39055: Add change to Koha::App::Plugin::CSRF and fix unit test -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Patch doesn't apply |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #192350|0 |1 is obsolete| | --- Comment #21 from David Cook <dcook@prosentient.com.au> --- Created attachment 193674 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193674&action=edit Bug 39055: Change "op" to "login_op" when logging in to allow original op to flow through This patch changes "op" to "login_op" when logging in, so that the original op can flow through to whichever controller is processing the login and subsequent op. Test plan: 0. apply the patch and koha-plack --restart kohadev 1. Without logging in, go to the following: http://localhost:8081/cgi-bin/koha/reports/guided_reports.pl?id=1&op=run 2. Log in and note that you can see the report 3. Try logging into the OPAC 4. Try logging into the self-checkout 5. Create a new self-reg account and try logging in with the auto-filled details 6. Test anything else you can think to test here Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #192351|0 |1 is obsolete| | --- Comment #22 from David Cook <dcook@prosentient.com.au> --- Created attachment 193675 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193675&action=edit Bug 39055: Fix mojo/acquisition/vendors.t Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #192352|0 |1 is obsolete| | --- Comment #23 from David Cook <dcook@prosentient.com.au> --- Created attachment 193676 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193676&action=edit Bug 39055: Add more login_op checks to middleware Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #192353|0 |1 is obsolete| | --- Comment #24 from David Cook <dcook@prosentient.com.au> --- Created attachment 193677 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193677&action=edit Bug 39055: Add change to Koha::App::Plugin::CSRF and fix unit test Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #192354|0 |1 is obsolete| | --- Comment #25 from David Cook <dcook@prosentient.com.au> --- Created attachment 193678 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193678&action=edit Bug 39055: Fix login condition when using op and login_op -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #26 from David Cook <dcook@prosentient.com.au> --- Thanks for checking, David. I've rebased! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193674|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193675|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193676|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193677|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193678|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #27 from David Nind <david@davidnind.com> --- Created attachment 193694 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193694&action=edit Bug 39055: Change "op" to "login_op" when logging in to allow original op to flow through This patch changes "op" to "login_op" when logging in, so that the original op can flow through to whichever controller is processing the login and subsequent op. Test plan: 0. apply the patch and koha-plack --restart kohadev 1. Without logging in, go to the following: http://localhost:8081/cgi-bin/koha/reports/guided_reports.pl?id=1&op=run 2. Log in and note that you can see the report 3. Try logging into the OPAC 4. Try logging into the self-checkout 5. Create a new self-reg account and try logging in with the auto-filled details 6. Test anything else you can think to test here Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #28 from David Nind <david@davidnind.com> --- Created attachment 193695 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193695&action=edit Bug 39055: Fix mojo/acquisition/vendors.t Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #29 from David Nind <david@davidnind.com> --- Created attachment 193696 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193696&action=edit Bug 39055: Add more login_op checks to middleware Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #30 from David Nind <david@davidnind.com> --- Created attachment 193697 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193697&action=edit Bug 39055: Add change to Koha::App::Plugin::CSRF and fix unit test Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #31 from David Nind <david@davidnind.com> --- Created attachment 193698 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193698&action=edit Bug 39055: Fix login condition when using op and login_op Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #32 from David Nind <david@davidnind.com> --- Testing notes (using KTD): 1. Replicate the issue as described in the description before applying the patches. - Report example: select * from biblio 2. Tests should pass: - prove t/db_dependent/mojo/acquisition/vendors.t - prove t/db_dependent/mojo/csrf.t -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #33 from David Cook <dcook@prosentient.com.au> --- Thanks, David! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This change fixes the login release notes| |so that pages that use "op" | |still work following a | |login prompt. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193694|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193695|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193696|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193697|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193698|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #34 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 194980 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194980&action=edit Bug 39055: Change "op" to "login_op" when logging in to allow original op to flow through This patch changes "op" to "login_op" when logging in, so that the original op can flow through to whichever controller is processing the login and subsequent op. Test plan: 0. apply the patch and koha-plack --restart kohadev 1. Without logging in, go to the following: http://localhost:8081/cgi-bin/koha/reports/guided_reports.pl?id=1&op=run 2. Log in and note that you can see the report 3. Try logging into the OPAC 4. Try logging into the self-checkout 5. Create a new self-reg account and try logging in with the auto-filled details 6. Test anything else you can think to test here Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #35 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 194981 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194981&action=edit Bug 39055: Fix mojo/acquisition/vendors.t Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #36 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 194982 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194982&action=edit Bug 39055: Add more login_op checks to middleware Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #37 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 194983 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194983&action=edit Bug 39055: Add change to Koha::App::Plugin::CSRF and fix unit test Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #38 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 194984 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194984&action=edit Bug 39055: Fix login condition when using op and login_op Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #39 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- kohadev-koha@kohadevbox:koha(main)$ prove -v xt/find-missing-op-in-forms.t xt/find-missing-op-in-forms.t .. 1..3 ok 1 - We should test something not ok 2 - The <form> in the following files are missing it's corresponding op parameter, or op does not start with 'cud-' (see bug 34478) # Failed test 'The <form> in the following files are missing it's corresponding op parameter, or op does not start with 'cud-' (see bug 34478)' # at xt/find-missing-op-in-forms.t line 39. # got: '7' # expected: '0' # $VAR1 = 'koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt:161,254'; # $VAR2 = 'koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt:58'; # $VAR3 = 'koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc:465'; # $VAR4 = 'koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt:237'; # $VAR5 = 'koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt:172'; # $VAR6 = 'koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt:110'; # $VAR7 = 'koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt:331'; -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Failed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #40 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 195045 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195045&action=edit Bug 39055: Adjust xt tests to handle login_op Patch from commit b0718a4 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #41 from David Cook <dcook@prosentient.com.au> --- Thanks, Jonathan. Much appreciated! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |26.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #42 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Thanks for all the hard work! Pushed to main for the next 26.05.00 release as RM Assistant -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Magnus Enger <magnus@libriotech.no> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |magnus@libriotech.no --- Comment #43 from Magnus Enger <magnus@libriotech.no> --- Looks like the problem getting fixed here is causing problems for us on 25.05.x. Any chance of a backport? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Chloé Zermatten <chloe.zermatten@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|26.05.00 |26.05.00,25.11.04 released in| | Status|Pushed to main |Pushed to stable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #44 from Chloé Zermatten <chloe.zermatten@openfifth.co.uk> --- All pushed to 25.11.x Thanks all! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Andrii Nugged <nugged@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=42494 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |42521 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42521 [Bug 42521] Cannot login from suggestion.pl -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #45 from Jonathan Druart <jonathan.druart@gmail.com> --- David, shouldn't we have removed this 'op' line? + $uri->query_param_delete('login_op'); $uri->query_param_delete('op'); # this one -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #46 from Jonathan Druart <jonathan.druart@gmail.com> --- (In reply to Jonathan Druart from comment #45)
David, shouldn't we have removed this 'op' line?
+ $uri->query_param_delete('login_op'); $uri->query_param_delete('op'); # this one
Note that I will remove it on bug 42523. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 --- Comment #47 from David Cook <dcook@prosentient.com.au> --- (In reply to Jonathan Druart from comment #46)
(In reply to Jonathan Druart from comment #45)
David, shouldn't we have removed this 'op' line?
+ $uri->query_param_delete('login_op'); $uri->query_param_delete('op'); # this one
Note that I will remove it on bug 42523.
I guess so although it seems like it wasn't causing a problem. Weird... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting CC| |wainuiwitikapark@catalyst.n | |et.nz --- Comment #48 from Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> --- Not backporting to 25.05.x - patch doesn't apply -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39055 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Needs documenting |RESOLVED --- Comment #49 from David Nind <david@davidnind.com> --- Bug fix, no changes to the manual required. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org