[Bug 40625] New: Cashup re-submissions on page reload
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Bug ID: 40625 Summary: Cashup re-submissions on page reload Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Point of Sale Assignee: koha-bugs@lists.koha-community.org Reporter: martin.renvoize@openfifth.co.uk QA Contact: testopia@bugs.koha-community.org CC: martin.renvoize@openfifth.co.uk The point of sale Cashup submission should use post/redirect/get pattern. We have been seeing duplicate cashup records and have identified that it's after an initial cashup has been performed and the user has left the page open. When they return, they reload the page (or Chrome auto-reloads it) and it performs the post again causing an empty or unexpected cashup to be recorded. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |hdunne-howrie@westminster.g | |ov.uk -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |martin.renvoize@openfifth.c |ity.org |o.uk -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 --- Comment #1 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 185284 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=185284&action=edit Bug 40625: Fix duplicate cashup records via POST/REDIRECT/GET pattern The cashup functionality on both /pos/register.pl and /pos/registers.pl pages was using GET requests via anchor tags, which could cause duplicate cashup records when users refreshed the page after performing a cashup. This patch implements proper POST/REDIRECT/GET pattern with CSRF protection: 1. Convert anchor tag buttons to proper HTML forms with submit buttons 2. Add CSRF token protection to all cashup operations 3. Change operation from 'cashup' to 'cud-cashup' for CSRF compliance 4. Implement redirects after successful cashup operations to prevent resubmission 5. Update JavaScript to populate form fields instead of href attributes This ensures cashup operations follow HTTP semantics properly (POST for state changes) and prevents duplicate submissions while maintaining the existing user experience. Test plan: 1. Apply patch and restart services 2. Go to Point of Sale > Cash registers 3. Click "Record cashup" on any register - should open modal 4. Click "Confirm" - should perform cashup and reload page 5. Refresh the page - should NOT create duplicate cashup record 6. Go to Point of Sale > Register for individual register 7. Click "Record cashup" - should open modal 8. Click "Confirm" - should perform cashup and reload page 9. Refresh the page - should NOT create duplicate cashup record 10. On registers page, try "Cashup all" button - should work correctly 11. Verify all existing functionality (modals, summaries) still works 12. Check browser developer tools - all requests should be POST for cashup operations -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |40445 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40445 [Bug 40445] Point of Sale reconciliation input during daily summaries -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off Patch complexity|--- |Small patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #185284|0 |1 is obsolete| | --- Comment #2 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 185404 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=185404&action=edit Bug 40625: Fix duplicate cashup records via POST/REDIRECT/GET pattern The cashup functionality on both /pos/register.pl and /pos/registers.pl pages was using GET requests via anchor tags, which could cause duplicate cashup records when users refreshed the page after performing a cashup. This patch implements proper POST/REDIRECT/GET pattern with CSRF protection: 1. Convert anchor tag buttons to proper HTML forms with submit buttons 2. Add CSRF token protection to all cashup operations 3. Change operation from 'cashup' to 'cud-cashup' for CSRF compliance 4. Implement redirects after successful cashup operations to prevent resubmission 5. Update JavaScript to populate form fields instead of href attributes This ensures cashup operations follow HTTP semantics properly (POST for state changes) and prevents duplicate submissions while maintaining the existing user experience. Test plan: 1. Apply patch and restart services 2. Go to Point of Sale > Cash registers 3. Click "Record cashup" on any register - should open modal 4. Click "Confirm" - should perform cashup and reload page 5. Refresh the page - should NOT create duplicate cashup record 6. Go to Point of Sale > Register for individual register 7. Click "Record cashup" - should open modal 8. Click "Confirm" - should perform cashup and reload page 9. Refresh the page - should NOT create duplicate cashup record 10. On registers page, try "Cashup all" button - should work correctly 11. Verify all existing functionality (modals, summaries) still works 12. Check browser developer tools - all requests should be POST for cashup operations Signed-off-by: Owen Leonard <oleonard@myacpl.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nick@bywatersolutions.com, | |tomascohen@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |tomascohen@gmail.com |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |38728 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38728 [Bug 38728] Add option to automatically trigger cashup summary modal after cashup -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |13985 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13985 [Bug 13985] [Omnibus] Cash Management - Koha as 'Point of Sale' -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|13985 | Depends on| |13985 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13985 [Bug 13985] [Omnibus] Cash Management - Koha as 'Point of Sale' -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #185404|0 |1 is obsolete| | --- Comment #3 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 186892 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=186892&action=edit Bug 40625: Fix duplicate cashup records via POST/REDIRECT/GET pattern This works great! Thank you, Martin. QA tool is also happy! The cashup functionality on both /pos/register.pl and /pos/registers.pl pages was using GET requests via anchor tags, which could cause duplicate cashup records when users refreshed the page after performing a cashup. This patch implements proper POST/REDIRECT/GET pattern with CSRF protection: 1. Convert anchor tag buttons to proper HTML forms with submit buttons 2. Add CSRF token protection to all cashup operations 3. Change operation from 'cashup' to 'cud-cashup' for CSRF compliance 4. Implement redirects after successful cashup operations to prevent resubmission 5. Update JavaScript to populate form fields instead of href attributes This ensures cashup operations follow HTTP semantics properly (POST for state changes) and prevents duplicate submissions while maintaining the existing user experience. Test plan: 1. Apply patch and restart services 2. Go to Point of Sale > Cash registers 3. Click "Record cashup" on any register - should open modal 4. Click "Confirm" - should perform cashup and reload page 5. Refresh the page - should NOT create duplicate cashup record 6. Go to Point of Sale > Register for individual register 7. Click "Record cashup" - should open modal 8. Click "Confirm" - should perform cashup and reload page 9. Refresh the page - should NOT create duplicate cashup record 10. On registers page, try "Cashup all" button - should work correctly 11. Verify all existing functionality (modals, summaries) still works 12. Check browser developer tools - all requests should be POST for cashup operations Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|tomascohen@gmail.com |Laura.escamilla@bywatersolu | |tions.com CC| |Laura.escamilla@bywatersolu | |tions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |25.11.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 --- Comment #4 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Nice work everyone! Pushed to main for 25.11 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Cashup re-submissions on |Prevent cashup |page reload |re-submissions on page | |reload -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |normal -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on|13985 | Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13985 [Bug 13985] [Omnibus] Cash Management - Koha as 'Point of Sale' -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|25.11.00 |25.11.00,25.05.06 released in| | Status|Pushed to main |Pushed to stable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 --- Comment #5 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Nice work everyone! Pushed to 25.05.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable CC| |fridolin.somers@biblibre.co | |m Version(s)|25.11.00,25.05.06 |25.11.00,25.05.06,24.11.11 released in| | --- Comment #6 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to 24.11.x for 24.11.11 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40625 Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldstable |Needs documenting CC| |wainuiwitikapark@catalyst.n | |et.nz --- Comment #7 from Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> --- Not backporting to 22.11.x -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org