[Bug 37523] New: CSRF error when modifying an existing patron record
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37523 Bug ID: 37523 Summary: CSRF error when modifying an existing patron record Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Patrons Assignee: koha-bugs@lists.koha-community.org Reporter: johanna.raisa@koha-suomi.fi QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com, kyle.m.hall@gmail.com When Koha finds a duplicate patron and you are trying to modify it, Koha will throw an error: Programming error - op 'edit_form' must start with 'cud-' for POST http://127.0.0.1:8081/intranet/members/memberentry.pl (referer: http://127.0.0.1:8081/cgi-bin/koha/members/memberentry.pl) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37523 Johanna Räisä <johanna.raisa@koha-suomi.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |major Priority|P5 - low |P1 - high -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37523 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED Assignee|koha-bugs@lists.koha-commun |oleonard@myacpl.org |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37523 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37523 --- Comment #1 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 169857 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169857&action=edit Bug 37523: CSRF error when modifying an existing patron record This patch modifies the patron entry template to avoid a CSRF error when clicking the "Edit existing record" button after a duplicate patron is found. The operation should be GET and thus can be a link. To test, apply the patch and go to Patrons. - If you aren't using the default testing data you should first locate an existing patron record so you can refer to the details. - Start the process of creating a new patron record. - Use the existing patron's data to fill out the form. - With the default data you can use: - Surname: Bennett - First name: Pamela - Date of birth: 09/16/1946 - Any random new card number - When you click "Save" you should get a duplicate patron warning: "Duplicate patron record?" - Click "It is a duplicate. Edit existing record." - You should be taken to the edit form for the existing patron. Sponsored-by: Athens County Public Libraries -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37523 Roman Dolny <roman.dolny@jezuici.pl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37523 Roman Dolny <roman.dolny@jezuici.pl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #169857|0 |1 is obsolete| | --- Comment #2 from Roman Dolny <roman.dolny@jezuici.pl> --- Created attachment 169867 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169867&action=edit Bug 37523: CSRF error when modifying an existing patron record This patch modifies the patron entry template to avoid a CSRF error when clicking the "Edit existing record" button after a duplicate patron is found. The operation should be GET and thus can be a link. To test, apply the patch and go to Patrons. - If you aren't using the default testing data you should first locate an existing patron record so you can refer to the details. - Start the process of creating a new patron record. - Use the existing patron's data to fill out the form. - With the default data you can use: - Surname: Bennett - First name: Pamela - Date of birth: 09/16/1946 - Any random new card number - When you click "Save" you should get a duplicate patron warning: "Duplicate patron record?" - Click "It is a duplicate. Edit existing record." - You should be taken to the edit form for the existing patron. Sponsored-by: Athens County Public Libraries Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37523 Johanna Räisä <johanna.raisa@koha-suomi.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #169867|0 |1 is obsolete| | --- Comment #3 from Johanna Räisä <johanna.raisa@koha-suomi.fi> --- Created attachment 169880 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169880&action=edit Bug 37523: CSRF error when modifying an existing patron record This patch modifies the patron entry template to avoid a CSRF error when clicking the "Edit existing record" button after a duplicate patron is found. The operation should be GET and thus can be a link. To test, apply the patch and go to Patrons. - If you aren't using the default testing data you should first locate an existing patron record so you can refer to the details. - Start the process of creating a new patron record. - Use the existing patron's data to fill out the form. - With the default data you can use: - Surname: Bennett - First name: Pamela - Date of birth: 09/16/1946 - Any random new card number - When you click "Save" you should get a duplicate patron warning: "Duplicate patron record?" - Click "It is a duplicate. Edit existing record." - You should be taken to the edit form for the existing patron. Sponsored-by: Athens County Public Libraries Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> Signed-off-by: Johanna Räisä <johanna.raisa@gmail.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37523 Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |emily.lamancusa@montgomeryc | |ountymd.gov QA Contact|testopia@bugs.koha-communit |emily.lamancusa@montgomeryc |y.org |ountymd.gov -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37523 Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #169880|0 |1 is obsolete| | --- Comment #4 from Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> --- Created attachment 169916 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169916&action=edit Bug 37523: CSRF error when modifying an existing patron record This patch modifies the patron entry template to avoid a CSRF error when clicking the "Edit existing record" button after a duplicate patron is found. The operation should be GET and thus can be a link. To test, apply the patch and go to Patrons. - If you aren't using the default testing data you should first locate an existing patron record so you can refer to the details. - Start the process of creating a new patron record. - Use the existing patron's data to fill out the form. - With the default data you can use: - Surname: Bennett - First name: Pamela - Date of birth: 09/16/1946 - Any random new card number - When you click "Save" you should get a duplicate patron warning: "Duplicate patron record?" - Click "It is a duplicate. Edit existing record." - You should be taken to the edit form for the existing patron. Sponsored-by: Athens County Public Libraries Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> Signed-off-by: Johanna Räisä <johanna.raisa@gmail.com> Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37523 Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA --- Comment #5 from Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> --- This works and QA tool passes. This really doesn't need to be a form submission; the direct link works fine, so the new coding guideline (JS16) doesn't apply here. Passing QA. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37523 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |24.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37523 --- Comment #6 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.11! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37523 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com Status|Pushed to main |Pushed to stable Version(s)|24.11.00 |24.11.00,24.05.04 released in| | --- Comment #7 from Lucas Gass <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.04 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37523 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Status|Pushed to stable |Needs documenting --- Comment #8 from Fridolin Somers <fridolin.somers@biblibre.com> --- Not for 23.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37523 Aude Charillon <aude.charillon@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |aude.charillon@ptfs-europe. | |com Resolution|--- |FIXED Status|Needs documenting |RESOLVED --- Comment #9 from Aude Charillon <aude.charillon@ptfs-europe.com> --- No update to the Koha Manual needed. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org