[Bug 36243] New: ILL "Edit request" action is broken
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 Bug ID: 36243 Summary: ILL "Edit request" action is broken Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: ILL Assignee: pedro.amorim@ptfs-europe.com Reporter: pedro.amorim@ptfs-europe.com CC: david@davidnind.com, martin.renvoize@ptfs-europe.com, nugged@gmail.com, pedro.amorim@ptfs-europe.com, tomascohen@gmail.com, victor@tuxayo.net Depends on: 34478 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 [Bug 34478] Full CSRF protection -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 Pedro Amorim <pedro.amorim@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 --- Comment #1 from Pedro Amorim <pedro.amorim@ptfs-europe.com> --- Created attachment 162832 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162832&action=edit Bug 36243: Remove cud- from op 'cud-' needs to be removed here because it's showing the form, not handling its POST submission -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 --- Comment #2 from Pedro Amorim <pedro.amorim@ptfs-europe.com> --- Created attachment 162833 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162833&action=edit Bug 36243: Update edit_action to cud-edit_action 1) Install FreeForm, enable ILL module, run: bash <(curl -s https://raw.githubusercontent.com/ammopt/koha-ill-dev/master/start-ill-dev.s...) 2) You'll have to switch the FreeForm branch to the one compatible with this work, i.e.: cd /kohadevbox/koha/Koha/Illbackends/FreeForm git checkout b_36243 3) Restart plack: koha-plack --restart kohadev 4) Create a new FreeForm request, visit: <staff_url>/cgi-bin/koha/ill/ill-requests.pl?method=create&backend=FreeForm 5) Set 'type' enter '42' in cardnumber and pick a library. Click 'Create'. 6) Edit that request, click "manage request" or if #1 visit: <staff_url>/cgi-bin/koha/ill/ill-requests.pl?op=illview&illrequest_id=1 7) Click "Edit request". Click "Submit". Notice it errors "No CSRF token passed for POST" 9) Apply patches. Restart plack. 10) Repeat 7) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 Pedro Amorim <pedro.amorim@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |36245 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36245 [Bug 36245] ILL - Custom backend form action is broken -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 Pedro Amorim <pedro.amorim@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |regression -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 Pedro Amorim <pedro.amorim@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |normal -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 Pedro Amorim <pedro.amorim@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |36249 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36249 [Bug 36249] ILL - "Request from partners" action is broken -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #162832|0 |1 is obsolete| | --- Comment #3 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 162869 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162869&action=edit Bug 36243: Remove cud- from op 'cud-' needs to be removed here because it's showing the form, not handling its POST submission Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #162833|0 |1 is obsolete| | --- Comment #4 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 162870 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162870&action=edit Bug 36243: Update edit_action to cud-edit_action 1) Install FreeForm, enable ILL module, run: bash <(curl -s https://raw.githubusercontent.com/ammopt/koha-ill-dev/master/start-ill-dev.s...) 2) You'll have to switch the FreeForm branch to the one compatible with this work, i.e.: cd /kohadevbox/koha/Koha/Illbackends/FreeForm git checkout b_36243 3) Restart plack: koha-plack --restart kohadev 4) Create a new FreeForm request, visit: <staff_url>/cgi-bin/koha/ill/ill-requests.pl?method=create&backend=FreeForm 5) Set 'type' enter '42' in cardnumber and pick a library. Click 'Create'. 6) Edit that request, click "manage request" or if #1 visit: <staff_url>/cgi-bin/koha/ill/ill-requests.pl?op=illview&illrequest_id=1 7) Click "Edit request". Click "Submit". Notice it errors "No CSRF token passed for POST" 9) Apply patches. Restart plack. 10) Repeat 7) Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off Severity|normal |critical QA Contact| |martin.renvoize@ptfs-europe | |.com --- Comment #5 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Follow-up fix for regression introduced. All working as designed now and code is reasonable to follow. Going straight for a QA and passing. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 Pedro Amorim <pedro.amorim@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|36245 | Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36245 [Bug 36245] ILL - Custom backend form action is broken -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 --- Comment #6 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Can we add the _form suffix to the op parameter? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 --- Comment #7 from Pedro Amorim <pedro.amorim@ptfs-europe.com> --- (In reply to Tomás Cohen Arazi from comment #6)
Can we add the _form suffix to the op parameter?
Yes, we can. And we should. Though it'll require a rewrite on how $op is handled in ill-requests.pl and ill-requests.tt. The focus of this bug is to fix the regression. ill-requests.pl handles an edit_action "form" and an edit_action "save" in the same $op eq 'edit_action', which means these would have to be decoupled to cud-edit_action and edit_action_form. The same would have to be made for cud-create, cud-generic_confirm, cud-delete (?) and possibly others. We'd also have to account for the fact that existing backends may have not yet adopted these new $op names (See get_op_param_deprecation in Illrequest.pm) In short, my suggestion would be to push this refactor/clean-up work to its own bug, but I'm obviously happy to discuss if you or others disagree. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 --- Comment #8 from Tomás Cohen Arazi <tomascohen@gmail.com> --- (In reply to Pedro Amorim from comment #7)
(In reply to Tomás Cohen Arazi from comment #6)
Can we add the _form suffix to the op parameter?
Yes, we can. And we should. Though it'll require a rewrite on how $op is handled in ill-requests.pl and ill-requests.tt. The focus of this bug is to fix the regression.
FAIR. Put some FIXME inline so there are no oversights on this later. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 Pedro Amorim <pedro.amorim@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |36273 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36273 [Bug 36273] ILL - Refactor $op in ill-requests.pl -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 --- Comment #9 from Pedro Amorim <pedro.amorim@ptfs-europe.com> --- I've added bug 36273. Please take a look to see if what I wrote there makes sense. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |24.05.00 released in| | Status|Passed QA |Pushed to master -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 --- Comment #10 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Resolution|--- |FIXED Status|Pushed to master |RESOLVED --- Comment #11 from Fridolin Somers <fridolin.somers@biblibre.com> --- Depends on Bug 34478 not in 23.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 Bug 36243 depends on bug 34478, which changed state. Bug 34478 Summary: Full CSRF protection https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org