[Bug 18975] New: Wrong CSRF token when emailing cart contents
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18975 Bug ID: 18975 Summary: Wrong CSRF token when emailing cart contents Change sponsored?: --- Product: Koha Version: 16.11 Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: OPAC Assignee: oleonard@myacpl.org Reporter: bc@interleaf.ie QA Contact: testopia@bugs.koha-community.org When you are not logged into the OPAC and attempt to email the contents of your cart you get the following error : "Wrong CSRF token at /usr/share/koha/opac/cgi-bin/opac/opac-sendbasket.pl line 55" Some testing shows: If you log in before adding items to your cart then send it, it works. If you're not logged in and you log in as part of sending the basket, the error occurs It must be that authenticating in that window doesn't set the session and id / secret aren't being set before submitting If you aren't logged in, click send the basket and log in, refresh the page before sending, then send, it forces it to pick up the session and works -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18975 Liz Rea <liz@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |liz@catalyst.net.nz --- Comment #1 from Liz Rea <liz@catalyst.net.nz> --- I confirm this bug in 16.11.05. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18975 Marjorie Barry-Vila <marjorie.barry-vila@collecto.ca> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |marjorie.barry-vila@collect | |o.ca -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18975 Patrick Robitaille <patrick.robitaille@collecto.ca> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |patrick.robitaille@collecto | |.ca -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18975 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED Severity|normal |major Version|16.11 |master CC| |jonathan.druart@bugs.koha-c | |ommunity.org --- Comment #2 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- It affects master as well -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18975 --- Comment #3 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 70084 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=70084&action=edit Bug 18975: Retrieve up-to-date CGISESSID when just logged in If a user is asked to login before sending a card, the wrong (old) CGISESSID cookie is used. We need to retrieve the one that has just been created. This will certainly need more work, I guess other scripts are affected too. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18975 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|oleonard@myacpl.org |jonathan.druart@bugs.koha-c | |ommunity.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18975 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de --- Comment #4 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Should this be NSO? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18975 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff --- Comment #5 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- I do not have time to investigate more the other scripts, but this one patch can be tested yes. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18975 Claire Gravely <claire_gravely@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18975 Claire Gravely <claire_gravely@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #70084|0 |1 is obsolete| | --- Comment #6 from Claire Gravely <claire_gravely@hotmail.com> --- Created attachment 71480 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=71480&action=edit Bug 18975: Retrieve up-to-date CGISESSID when just logged in If a user is asked to login before sending a card, the wrong (old) CGISESSID cookie is used. We need to retrieve the one that has just been created. This will certainly need more work, I guess other scripts are affected too. Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18975 Jessie Zairo <jzairo@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jzairo@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18975 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18975 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #71480|0 |1 is obsolete| | --- Comment #7 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 71883 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=71883&action=edit Bug 18975: Retrieve up-to-date CGISESSID when just logged in If a user is asked to login before sending a card, the wrong (old) CGISESSID cookie is used. We need to retrieve the one that has just been created. This will certainly need more work, I guess other scripts are affected too. Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18975 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master --- Comment #8 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Pushed to master for 18.05, thanks to everybody involved! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18975 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable CC| |nick@bywatersolutions.com --- Comment #9 from Nick Clemens <nick@bywatersolutions.com> --- Awesome work all! Pushed to stable for 17.11.03 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org