[Bug 39570] New: Add item form includes itemnumber while adding a new item
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39570 Bug ID: 39570 Summary: Add item form includes itemnumber while adding a new item Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Cataloging Assignee: koha-bugs@lists.koha-community.org Reporter: phil@chetcolibrary.org QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl Depends on: 36192 Luckily, submitting an itemnumber that's either empty or bogus while adding a new item doesn't actually do anything since the code for op == 'cud-additem' doesn't ever look at itemnumber, but it's confusing and scary looking in the case where you add an item after editing an existing item. The template looks at [% IF op != 'add_item' %] to decide to add the <input type="hidden" name="itemnumber" value="[% itemnumber | html %]" />. Prior to the bug 36192 CSRF protection, that worked, but now the op for adding an item is cud-additem, so it's always true and we always submit an itemnumber. And without bug 27625 it would have been less scary looking, since before then while processing the editing of an item we cleared $itemnumber after we were done using it, so it at least would have been value="". Now, if you edit an existing item and then add another, the form you submit to add an item includes the itemnumber of the item you previously edited. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39570 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=31323 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39570 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39570 --- Comment #1 from Phil Ringnalda <phil@chetcolibrary.org> --- Created attachment 180682 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=180682&action=edit Bug 39570: Add item form includes itemnumber while adding a new item Because the template uses the wrong op, add_item rather than cud-additem, to decide whether to include a hidden input with the itemnumber, if you edit an item and then add another item you wind up submitting a form that includes the previous itemnumber when you add a new one. Nothing happens, because the code for adding an item doesn't look at $input->param('itemnumber'), but since it doesn't mean anything we shouldn't be submitting it. Test plan: 1. Without the patch, find any biblio with at least one item attached, and in the items table click Edit item on one of them 2. Without needing to making any changes, click Save changes 3. In the page that loads, scroll down to the bottom of the Add item form, right-click the Add item button, and choose Inspect 4. A few lines up, above a '<fieldset class="action">,' there will be an '<input type="hidden" name="itemnumber" value="633">' with the itemnumber of the item you previously edited 5. Apply patch 6. Scroll up, click Actions - Edit on any item, then Save changes 7. Again, right-click the Add item button, Inspect, note that there isn't a itemnumber input with the number of the item you previously edited Sponsored-by: Chetco Community Public Library -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39570 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |phil@chetcolibrary.org |ity.org | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39570 Brendan Gallagher <brendan@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39570 Brendan Gallagher <brendan@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #180682|0 |1 is obsolete| | --- Comment #2 from Brendan Gallagher <brendan@bywatersolutions.com> --- Created attachment 180713 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=180713&action=edit Bug 39570: Add item form includes itemnumber while adding a new item Because the template uses the wrong op, add_item rather than cud-additem, to decide whether to include a hidden input with the itemnumber, if you edit an item and then add another item you wind up submitting a form that includes the previous itemnumber when you add a new one. Nothing happens, because the code for adding an item doesn't look at $input->param('itemnumber'), but since it doesn't mean anything we shouldn't be submitting it. Test plan: 1. Without the patch, find any biblio with at least one item attached, and in the items table click Edit item on one of them 2. Without needing to making any changes, click Save changes 3. In the page that loads, scroll down to the bottom of the Add item form, right-click the Add item button, and choose Inspect 4. A few lines up, above a '<fieldset class="action">,' there will be an '<input type="hidden" name="itemnumber" value="633">' with the itemnumber of the item you previously edited 5. Apply patch 6. Scroll up, click Actions - Edit on any item, then Save changes 7. Again, right-click the Add item button, Inspect, note that there isn't a itemnumber input with the number of the item you previously edited Sponsored-by: Chetco Community Public Library Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39570 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39570 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #180713|0 |1 is obsolete| | --- Comment #3 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 180814 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=180814&action=edit Bug 39570: Add item form includes itemnumber while adding a new item Because the template uses the wrong op, add_item rather than cud-additem, to decide whether to include a hidden input with the itemnumber, if you edit an item and then add another item you wind up submitting a form that includes the previous itemnumber when you add a new one. Nothing happens, because the code for adding an item doesn't look at $input->param('itemnumber'), but since it doesn't mean anything we shouldn't be submitting it. Test plan: 1. Without the patch, find any biblio with at least one item attached, and in the items table click Edit item on one of them 2. Without needing to making any changes, click Save changes 3. In the page that loads, scroll down to the bottom of the Add item form, right-click the Add item button, and choose Inspect 4. A few lines up, above a '<fieldset class="action">,' there will be an '<input type="hidden" name="itemnumber" value="633">' with the itemnumber of the item you previously edited 5. Apply patch 6. Scroll up, click Actions - Edit on any item, then Save changes 7. Again, right-click the Add item button, Inspect, note that there isn't a itemnumber input with the number of the item you previously edited Sponsored-by: Chetco Community Public Library Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39570 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |m.de.rooy@rijksmuseum.nl |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39570 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |25.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39570 --- Comment #4 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 25.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39570 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m --- Comment #5 from Fridolin Somers <fridolin.somers@biblibre.com> --- "Add item form includes itemnumber while adding a new item" => this is the bug commit message should explain the fix like : "Add item form must not include itemnumber while adding a new item" -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39570 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable Version(s)|25.05.00 |25.05.00,24.11.08 released in| | --- Comment #6 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to 24.11.x for 24.11.08 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39570 Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting --- Comment #7 from Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> --- Not backporting to 22.11.x as it wasn't backported to 24.05.x -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon@bugs.koha-community.org