[Bug 36326] New: Biblio detail view - Deletion of items is broken
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 Bug ID: 36326 Summary: Biblio detail view - Deletion of items is broken Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Cataloging Assignee: koha-bugs@lists.koha-community.org Reporter: pedro.amorim@ptfs-europe.com QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl Blocks: 36192 k-t-d 1) visit a biblio: http://localhost:8081/cgi-bin/koha/catalogue/detail.pl?biblionumber=230 2) Tick 2 checkboxes on the left most column of the items table 3) Click the " Delete selected items" action. 4) Notice you are taken to http://localhost:8081/cgi-bin/koha/tools/batchMod.pl?op=show&del=1&itemnumber=507&itemnumber=508&biblionumber=230&src=CATALOGUING 5) Notice the page is blank Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 Pedro Amorim <pedro.amorim@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |major CC| |jonathan.druart@gmail.com, | |martin.renvoize@ptfs-europe | |.com, | |nick@bywatersolutions.com, | |tomascohen@gmail.com -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 Pedro Amorim <pedro.amorim@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=36327 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 --- Comment #1 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 163227 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163227&action=edit Bug 36326: Fix batch item mod/del access from biblio detail page Allow both $op eq "show" and "cud-show". We need to keep the POST when we upload a file, but we can simply allow GET with "show". Test plan: Go to the biblio detail page, select an item and test both tools via the links "Delete selected items" and "Modify selected items" -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 --- Comment #2 from Jonathan Druart <jonathan.druart@gmail.com> --- Not the nicest fix, but the easiest. Other places have been fixed using a POST: commit 74d7ae7672a4b82568e57eaddefbded4bf5b05e6 Bug 34478: (follow-up) batchMod commit 925eb73a279e18194f05b92069d78fd93c88a58e Bug 34478: (follow-up) batch_record_modification -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |jonathan.druart@gmail.com |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 --- Comment #3 from Pedro Amorim <pedro.amorim@ptfs-europe.com> --- Created attachment 163238 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163238&action=edit Bug 36326: PoC Joubu, whats your opinion on this approach? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 --- Comment #4 from Pedro Amorim <pedro.amorim@ptfs-europe.com> --- Replacing "build link" logic with "build invisible form" logic. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 --- Comment #5 from Jonathan Druart <jonathan.druart@gmail.com> --- With bug 33568 in the queue, I really would prefer to limit the changes we add to this template. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 --- Comment #6 from Jonathan Druart <jonathan.druart@gmail.com> --- Otherwise the way to do would be to have a form with empty hidden inputs that we populate when the form is submitted. like what we do on commit 1415fee322a497a3dc7e511a61854a4099ea40a6 Bug 36193: cud- treatment for cash_registers.pl or commit c706fc9e41583f593bda7a555764f61116e11fbb Bug 34478: Replace delete links with form - smart-rules -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 Pedro Amorim <pedro.amorim@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #163238|0 |1 is obsolete| | --- Comment #7 from Pedro Amorim <pedro.amorim@ptfs-europe.com> --- Created attachment 163250 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163250&action=edit Bug 36326: PoC followup I've moved the static elements to the form instead of appending them. This does not overlap 100% with bug 36193 or 34478 as in those cases we're not adding inputs to the form dynamically, so we should/have to keep that in here. Let me know what you think. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 --- Comment #8 from Jonathan Druart <jonathan.druart@gmail.com> --- This second patch is causing a major conflict with bug 33568 while my single line patch is fixing the original problem without any conflicts. I would prefer to prevent change to this template until 33568 is pushed. I will be happy to provide a better fix on top of it once in master. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #163227|0 |1 is obsolete| | --- Comment #9 from David Nind <david@davidnind.com> --- Created attachment 163276 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163276&action=edit Bug 36326: Fix batch item mod/del access from biblio detail page Allow both $op eq "show" and "cud-show". We need to keep the POST when we upload a file, but we can simply allow GET with "show". Test plan: Go to the biblio detail page, select an item and test both tools via the links "Delete selected items" and "Modify selected items" Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com --- Comment #10 from David Nind <david@davidnind.com> --- I've signed off Jonathan's patch. Feel free to add me to the bug once bug 33568 is pushed. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |BLOCKED QA Contact|testopia@bugs.koha-communit |m.de.rooy@rijksmuseum.nl |y.org | --- Comment #11 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Looking here -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|BLOCKED |Passed QA Patch complexity|--- |Small patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #163276|0 |1 is obsolete| | --- Comment #12 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 163661 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163661&action=edit Bug 36326: Fix batch item mod/del access from biblio detail page Allow both $op eq "show" and "cud-show". We need to keep the POST when we upload a file, but we can simply allow GET with "show". Test plan: Go to the biblio detail page, select an item and test both tools via the links "Delete selected items" and "Modify selected items" Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #163250|0 |1 is obsolete| | --- Comment #13 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 163662 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163662&action=edit Bug 36326: PoC followup I've moved the static elements to the form instead of appending them. This does not overlap 100% with bug 36193 or 34478 as in those cases we're not adding inputs to the form dynamically, so we should/have to keep that in here. Let me know what you think. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #163661|0 |1 is obsolete| | --- Comment #14 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 163663 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163663&action=edit Bug 36326: Fix batch item mod/del access from biblio detail page Allow both $op eq "show" and "cud-show". We need to keep the POST when we upload a file, but we can simply allow GET with "show". Test plan: Go to the biblio detail page, select an item and test both tools via the links "Delete selected items" and "Modify selected items" Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Biblio detail view - |Batch deletion of selected |Deletion of items is broken |items from detail page is | |broken -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 --- Comment #15 from Jonathan Druart <jonathan.druart@gmail.com> --- Only the second patch should be needed here. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 --- Comment #16 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Waiting to push this one until discussion is resolved - please tidy commit message if this is the one to be pushed. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #163662|0 |1 is obsolete| | --- Comment #17 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Comment on attachment 163662 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163662 Bug 36326: PoC followup Yes, we can also push the other one on itself. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 --- Comment #18 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Jonathan Druart from comment #15)
Only the second patch should be needed here.
Confirmed -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |24.05.00 released in| | Status|Passed QA |Pushed to master -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 --- Comment #19 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Depends on| |34478 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 [Bug 34478] Full CSRF protection -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Pushed to master |RESOLVED --- Comment #20 from Fridolin Somers <fridolin.somers@biblibre.com> --- Depends on Bug 34478 not in 23.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 --- Comment #21 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- (In reply to Jonathan Druart from comment #8)
This second patch is causing a major conflict with bug 33568 while my single line patch is fixing the original problem without any conflicts. I would prefer to prevent change to this template until 33568 is pushed.
I will be happy to provide a better fix on top of it once in master.
Did we get the 'better fix' submitted anywhere? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 --- Comment #22 from Jonathan Druart <jonathan.druart@gmail.com> --- (In reply to Martin Renvoize from comment #21)
(In reply to Jonathan Druart from comment #8)
This second patch is causing a major conflict with bug 33568 while my single line patch is fixing the original problem without any conflicts. I would prefer to prevent change to this template until 33568 is pushed.
I will be happy to provide a better fix on top of it once in master.
Did we get the 'better fix' submitted anywhere?
I totally forgot about it, thanks for the reminder. I will work on it tomorrow, see bug 37309. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 Bug 36326 depends on bug 34478, which changed state. Bug 34478 Summary: Full CSRF protection https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org