[Bug 38413] New: Batch operations from item search results fail when "select visible rows" and many items are selected
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38413 Bug ID: 38413 Summary: Batch operations from item search results fail when "select visible rows" and many items are selected Change sponsored?: --- Product: Koha Version: 24.05 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Cataloging Assignee: koha-bugs@lists.koha-community.org Reporter: kkrueger@cuyahogalibrary.org QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl To replicate: 1. Go to item search. 2. Enter parameters that retrieve more than 500 items. 3. From the item search results page, show All entries, then "Select visible rows" 4. Select either of the batch operations (Batch item modification or batch item deletion) 5. A resulting error message of either "This site can't be reached. The connection was reset" or a URL with all the item numbers inserted appears. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38413 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |major Status|NEW |CONFIRMED CC| |phil@chetcolibrary.org Depends on| |36630 --- Comment #1 from Phil Ringnalda <phil@chetcolibrary.org> --- That's because bug 36630 changed it from a POST to a GET, which runs the risk of exceeding the maximum URL length. It was fooled into making the wrong change in the wrong place by a dummy op. The way both batch modification and batch deletion work in item search is by completely emptying out the content of the form with id="batch_item_operations", sticking in an op and inputs for every selected item, and submitting that. The bulk CSRF-proctection changes were fooled by the dummy initial content of the form, so they changed the op from show to cud-show and added a CSRF token, but the JavaScript that actually prepares and submits the form just went right along deleting all of that, then adding back op="show" and not adding a CSRF token. The fix is to reverse the changes bug 36630 made so the form goes back to a POST, stick in an HTML comment above the dummy contents saying that they are dummy contents that will be replaced by JavaScript, and then change the op in https://git.koha-community.org/Koha-community/Koha/src/commit/c10c244a289b2c... to cud-show and add a CSRF token input. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36630 [Bug 36630] Item search batch operations buttons broken by CSRF -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38413 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|CONFIRMED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38413 --- Comment #2 from Phil Ringnalda <phil@chetcolibrary.org> --- Created attachment 174311 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=174311&action=edit Bug 38413: Batch operations from item search need to POST to not exceed URL length limits Batch item modification and deletion accepts either op="show" or op="cud-show" because sometimes you just have one item and it's saner to GET with one, but sometimes you've selected 961 items from itemsearch and you need to POST to not get hit by Apache's "too long" error. Bug 36630 switched item search from using POST to GET because item search is confusing. It uses a form with a dummy op and then empties out the form and adds back contents, and the CSRF protection changed the dummy op to "cud-show" so it could POST, but didn't notice that the op would be replaced by one that was still "show." The form needs to go back to POST, the dummy contents need a comment saying they are just dummies so nobody else gets fooled, and the JS that replaces the form contents needs to insert a CSRF token and the correct op. Test plan: 1. Without the patch, Search - Item search, search with no criteria so you get hundreds of items 2. Change to Show All entries, then Select visible rows 3. Batch operations - Batch item modification 4. Apache should give you an error about your overly long URL 5. Apply patch and repeat steps 1-3 6. After a long pause while Batch item modification swallows the POST, you should get the batch modification form with all your items. Sponsored-by: Chetco Community Public Library -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38413 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |phil@chetcolibrary.org |ity.org | Priority|P5 - low |P3 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38413 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38413 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #174311|0 |1 is obsolete| | --- Comment #3 from David Nind <david@davidnind.com> --- Created attachment 174315 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=174315&action=edit Bug 38413: Batch operations from item search need to POST to not exceed URL length limits Batch item modification and deletion accepts either op="show" or op="cud-show" because sometimes you just have one item and it's saner to GET with one, but sometimes you've selected 961 items from itemsearch and you need to POST to not get hit by Apache's "too long" error. Bug 36630 switched item search from using POST to GET because item search is confusing. It uses a form with a dummy op and then empties out the form and adds back contents, and the CSRF protection changed the dummy op to "cud-show" so it could POST, but didn't notice that the op would be replaced by one that was still "show." The form needs to go back to POST, the dummy contents need a comment saying they are just dummies so nobody else gets fooled, and the JS that replaces the form contents needs to insert a CSRF token and the correct op. Test plan: 1. Without the patch, Search - Item search, search with no criteria so you get hundreds of items 2. Change to Show All entries, then Select visible rows 3. Batch operations - Batch item modification 4. Apache should give you an error about your overly long URL 5. Apply patch and repeat steps 1-3 6. After a long pause while Batch item modification swallows the POST, you should get the batch modification form with all your items. Sponsored-by: Chetco Community Public Library Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38413 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com Text to go in the| |This fixes an Apache web release notes| |server error ("Request-URI | |Too Long - The requested | |URL's length exceeds the | |capacity limit for this | |server.") when using item | |search and batch | |modification to edit many | |items (500+). -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38413 Emily Lamancusa (emlam) <emily.lamancusa@montgomerycountymd.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #174315|0 |1 is obsolete| | --- Comment #4 from Emily Lamancusa (emlam) <emily.lamancusa@montgomerycountymd.gov> --- Created attachment 174437 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=174437&action=edit Bug 38413: Batch operations from item search need to POST to not exceed URL length limits Batch item modification and deletion accepts either op="show" or op="cud-show" because sometimes you just have one item and it's saner to GET with one, but sometimes you've selected 961 items from itemsearch and you need to POST to not get hit by Apache's "too long" error. Bug 36630 switched item search from using POST to GET because item search is confusing. It uses a form with a dummy op and then empties out the form and adds back contents, and the CSRF protection changed the dummy op to "cud-show" so it could POST, but didn't notice that the op would be replaced by one that was still "show." The form needs to go back to POST, the dummy contents need a comment saying they are just dummies so nobody else gets fooled, and the JS that replaces the form contents needs to insert a CSRF token and the correct op. Test plan: 1. Without the patch, Search - Item search, search with no criteria so you get hundreds of items 2. Change to Show All entries, then Select visible rows 3. Batch operations - Batch item modification 4. Apache should give you an error about your overly long URL 5. Apply patch and repeat steps 1-3 6. After a long pause while Batch item modification swallows the POST, you should get the batch modification form with all your items. Sponsored-by: Chetco Community Public Library Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38413 Emily Lamancusa (emlam) <emily.lamancusa@montgomerycountymd.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |emily.lamancusa@montgomeryc | |ountymd.gov Status|Signed Off |Passed QA QA Contact|testopia@bugs.koha-communit |emily.lamancusa@montgomeryc |y.org |ountymd.gov -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38413 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|24.05 |Main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38413 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |24.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38413 --- Comment #5 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.11! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38413 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com Status|Pushed to main |Pushed to stable Version(s)|24.11.00 |24.11.00,24.05.06 released in| | --- Comment #6 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.06 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38413 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38413 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldstable |Needs documenting CC| |fridolin.somers@biblibre.co | |m --- Comment #7 from Fridolin Somers <fridolin.somers@biblibre.com> --- Depends on Bug 36630 not in 23.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38413 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Needs documenting |RESOLVED --- Comment #8 from David Nind <david@davidnind.com> --- This is a bug fix and no UI changes, so no changes to the documentation required. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org