[Bug 37039] New: Cannot request a discharge in the OPAC
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37039 Bug ID: 37039 Summary: Cannot request a discharge in the OPAC Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: ASSIGNED Severity: major Priority: P5 - low Component: OPAC Assignee: oleonard@myacpl.org Reporter: oleonard@myacpl.org QA Contact: testopia@bugs.koha-community.org The page needs to be updated with a valid CSRF form. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37039 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37039 --- Comment #1 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 167490 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167490&action=edit Bug 37039: Update discharge request with CSRF token The OPAC discharge page used a link with a GET parameter, but the script expects a POST request. This patch converts the link to a form with CSRF token included. To test, apply the patch and enable the useDischarge system preference if necessary. - Log in to the OPAC as a user with no checkouts or outstanding fees. - Click the "Ask for discharge" tab in the sidebar of the user summary page. - Click the "Ask for a discharge" button. - You should be redirected to a page that says "Your discharge request has been sent." -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37039 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |34478 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 [Bug 34478] Full CSRF protection -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37039 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37039 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167490|0 |1 is obsolete| | --- Comment #2 from David Nind <david@davidnind.com> --- Created attachment 167497 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167497&action=edit Bug 37039: Update discharge request with CSRF token The OPAC discharge page used a link with a GET parameter, but the script expects a POST request. This patch converts the link to a form with CSRF token included. To test, apply the patch and enable the useDischarge system preference if necessary. - Log in to the OPAC as a user with no checkouts or outstanding fees. - Click the "Ask for discharge" tab in the sidebar of the user summary page. - Click the "Ask for a discharge" button. - You should be redirected to a page that says "Your discharge request has been sent." Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37039 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |julian.maurice@biblibre.com |y.org | CC| |julian.maurice@biblibre.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37039 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167497|0 |1 is obsolete| | --- Comment #3 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 167575 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167575&action=edit Bug 37039: Update discharge request with CSRF token The OPAC discharge page used a link with a GET parameter, but the script expects a POST request. This patch converts the link to a form with CSRF token included. To test, apply the patch and enable the useDischarge system preference if necessary. - Log in to the OPAC as a user with no checkouts or outstanding fees. - Click the "Ask for discharge" tab in the sidebar of the user summary page. - Click the "Ask for a discharge" button. - You should be redirected to a page that says "Your discharge request has been sent." Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37039 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37039 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |24.11.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37039 --- Comment #4 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Thanks for all the hard work! Pushed to main for the next 24.11.00 release as RM Assistant -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37039 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com Status|Pushed to main |Pushed to stable Version(s)|24.11.00 |24.11.00,24.05.02 released in| | --- Comment #5 from Lucas Gass <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.02 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37039 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting CC| |fridolin.somers@biblibre.co | |m --- Comment #6 from Fridolin Somers <fridolin.somers@biblibre.com> --- Depends on Bug 34478 not in 23.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37039 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This fixes the OPAC release notes| |discharge request so that | |it now works as expected - | |after pressing the "Ask for | |a discharge" button, the | |page was refreshed but no | |request was made. (Requires | |useDischarge system | |preference enabled; OPAC > | |Your account > Ask for a | |discharge.) (This is | |related to the CSRF changes | |added in Koha 24.05 to | |improve form security.) CC| |david@davidnind.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37039 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Needs documenting |RESOLVED --- Comment #7 from David Nind <david@davidnind.com> --- No change required to the manual - fixes something not working. No changes to screenshots in the OAPC section required. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37039 Bug 37039 depends on bug 34478, which changed state. Bug 34478 Summary: Full CSRF protection https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org