[Bug 37533] New: Invalid query when receiving an order
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Bug ID: 37533 Summary: Invalid query when receiving an order Change sponsored?: --- Product: Koha Version: 23.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Acquisitions Assignee: koha-bugs@lists.koha-community.org Reporter: andreas.jonsson@kreablo.se QA Contact: testopia@bugs.koha-community.org There is an invalid query in koha-tmpl/intranet-tmpl/prog/en/modules/acqui/orderreceive.tt var base_query = { "order_id": {"in": [[% multiple_orders | html %]]}}; It should be: var base_query = { "order_id": {"-in": [[% multiple_orders | html %]]}}; The validation introduced in bug 37018 will not allow the operator "in". -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 --- Comment #1 from Andreas Jonsson <andreas.jonsson@kreablo.se> --- Created attachment 169881 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169881&action=edit Bug 37533: fix query in orderreceive.tt The new validation in the REST API will no longer allow the operator "in". Consequently, it has to be replaced with the allowed "-in". Test plan: * Open an invoice and click "Go to receipt page" and on any basket click "receive" and make sure the dialog box appears. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Andreas Jonsson <andreas.jonsson@kreablo.se> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch Status|NEW |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Andreas Jonsson <andreas.jonsson@kreablo.se> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #169881|0 |1 is obsolete| | --- Comment #2 from Andreas Jonsson <andreas.jonsson@kreablo.se> --- Created attachment 169882 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169882&action=edit Bug 37533: fix query in orderreceive.tt The new validation in the REST API will no longer allow the operator "in". Consequently, it has to be replaced with the allowed "-in". Test plan: * Open an invoice and click "Go to receipt page" and on any basket click "receive" and make sure the dialog box appears. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Andreas Jonsson <andreas.jonsson@kreablo.se> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - low |P3 Severity|enhancement |normal -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Aleisha Amohia <aleisha@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Aleisha Amohia <aleisha@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #169882|0 |1 is obsolete| | --- Comment #3 from Aleisha Amohia <aleisha@catalyst.net.nz> --- Created attachment 169923 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169923&action=edit Bug 37533: fix query in orderreceive.tt The new validation in the REST API will no longer allow the operator "in". Consequently, it has to be replaced with the allowed "-in". Test plan: * Open an invoice and click "Go to receipt page" and on any basket click "receive" and make sure the dialog box appears. Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Aleisha Amohia <aleisha@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |andreas.jonsson@kreablo.se |ity.org | CC| |aleisha@catalyst.net.nz Keywords| |rel_23_11_candidate -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 --- Comment #4 from David Cook <dcook@prosentient.com.au> --- I'm going to need more information on this one... Without the patch, I've gone to http://localhost:8081/cgi-bin/koha/acqui/parcel.pl?invoiceid=1 and I've received the item and had no problems. What's the bug that this is fixing? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 --- Comment #5 from Aleisha Amohia <aleisha@catalyst.net.nz> --- Here's how I reproduced the bug on 23.11.x: 1. Have a vendor and a basket 2. Add an order to the basket 3. Close the basket 4. Receive shipments 5. Add an invoice number and continue 6. On the receiving items page, click Receive in the row of your order 7. Instead of the usual pop-up window to receive my item, you get an error that says Something went wrong when loading the table. 400: Bad request. This patch solved this error and I was able to receive my item -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 --- Comment #6 from David Cook <dcook@prosentient.com.au> --- (In reply to Aleisha Amohia from comment #5)
Here's how I reproduced the bug on 23.11.x:
1. Have a vendor and a basket 2. Add an order to the basket 3. Close the basket 4. Receive shipments 5. Add an invoice number and continue 6. On the receiving items page, click Receive in the row of your order 7. Instead of the usual pop-up window to receive my item, you get an error that says Something went wrong when loading the table. 400: Bad request.
This patch solved this error and I was able to receive my item
Hmm... that's so interesting. That's the test plan I did on "main" and it worked fine. 172.20.0.1 - - [01/Aug/2024:04:14:13 +0000] "GET /api/v1/app.pl/api/v1/acquisitions/orders?only_active=1&q=%7B%22order_id%22:%7B%22in%22:%5B2%5D%7D%7D&_page=1&_per_page=20&_match=contains&_order_by=%2Bme.order_id HTTP/1.1" 200 - "http:// localhost:8081/cgi-bin/koha/acqui/orderreceive.pl?multiple_orders=2&invoiceid=1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" If bug 37018 were working, I would think that this should cause an error but doesn't. Curious. I suspected I needed to re-run "perl build-resources.PL" to update the API definitions, but even after doing that it is still working fine... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 --- Comment #7 from David Cook <dcook@prosentient.com.au> --- Yeah... something is rotten in Denmark. Bug 37018 is in a state of "Passed QA", some of the patches are in "23.11.07", but some are missing from "main". It's a right mess at the moment. I'll bring it up on bug 37018 and Mattermost... -- For this one, it's a simple change, so I'll check that it still works with it (it should), and then stamp it. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #169923|0 |1 is obsolete| | --- Comment #8 from David Cook <dcook@prosentient.com.au> --- Created attachment 169924 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169924&action=edit Bug 37533: fix query in orderreceive.tt The new validation in the REST API will no longer allow the operator "in". Consequently, it has to be replaced with the allowed "-in". Test plan: * Open an invoice and click "Go to receipt page" and on any basket click "receive" and make sure the dialog box appears. Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com> Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 --- Comment #9 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to David Cook from comment #7)
Yeah... something is rotten in Denmark.
Bug 37018 is in a state of "Passed QA", some of the patches are in "23.11.07", but some are missing from "main". It's a right mess at the moment.
I'll bring it up on bug 37018 and Mattermost...
--
For this one, it's a simple change, so I'll check that it still works with it (it should), and then stamp it.
This was in the security release from Tuesday. The security patches will be the next ones I push, but currently stuck on with some conflicts/failing tests - see security channel if you want to help things along. I can pick this up directly after they have been pushed. Assume the patches are there for testing maybe. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |dcook@prosentient.com.au |y.org | CC| |martin.renvoize@ptfs-europe | |.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |37018 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|normal |critical Keywords| |rel_24_05_candidate -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|23.11 |Main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |24.11.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 --- Comment #10 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.11! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |librarian@sageuniversity.in --- Comment #11 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- *** Bug 37555 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|critical |blocker -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Aleisha Amohia <aleisha@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |rel_23_05_candidate -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 wainuiwitikapark@catalyst.net.nz changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |37589 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37589 [Bug 37589] Edit link when receiving orders is not going to the correct page -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Andrew Fuerste-Henry <andrewfh@dubcolib.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |andrewfh@dubcolib.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 wainuiwitikapark@catalyst.net.nz changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|37589 | Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37589 [Bug 37589] Edit link when receiving orders is not going to the correct page -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|24.11.00 |24.11.00,24.05.04 released in| | Status|Pushed to main |Pushed to stable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 --- Comment #12 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Pushed to main for 24.11. Nice work everyone, thanks! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|24.11.00,24.05.04 |24.11.00,24.05.03 released in| | CC| |tomascohen@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com --- Comment #13 from Jonathan Druart <jonathan.druart@gmail.com> --- Why don't we allow "in" then? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 --- Comment #14 from David Cook <dcook@prosentient.com.au> --- (In reply to Jonathan Druart from comment #13)
Why don't we allow "in" then?
That's a good question. I imagine that "in" must've worked, although SQL::Abstract::Classic (and SQL::Abstract) seems to dictate "-in" in their docs. But the docs don't really explain it. Looking at the SQL::Abstract source code, it looks like it's expecting modifiers to start with "-". It's a bit hard to tell at a glance, but it kind of seems that "-in" and "in" might yield different structures (or at least take different code paths to get to the same place). Not sure if it's worth investigating or not, but probably good to require the "-" prefix. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 --- Comment #15 from Tomás Cohen Arazi <tomascohen@gmail.com> --- (In reply to Jonathan Druart from comment #13)
Why don't we allow "in" then?
I'm not sure how we've built the allow-list on bug 37018. But yes: another option would've been to just add it to the list. I feel like it is not a bad thing to be able to identify more precisely this operands. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|24.11.00,24.05.03 |24.11.00,24.05.03,23.11.08, released in| |23.05.14 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldstable |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|rel_23_05_candidate, | |rel_23_11_candidate, | |rel_24_05_candidate | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37533 Bug 37533 depends on bug 37018, which changed state. Bug 37018 Summary: SQL injection using q under api/ https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37018 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org