[Bug 39527] New: Cannot create a new notice when running Koha as a Mojolicious application
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39527 Bug ID: 39527 Summary: Cannot create a new notice when running Koha as a Mojolicious application Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Tools Assignee: julian.maurice@biblibre.com Reporter: julian.maurice@biblibre.com QA Contact: testopia@bugs.koha-community.org When running Koha as a mojolicious application, trying to create a new notice results in a CSRF error, because two different 'op' parameters are sent (one in the URL, one in the POST body) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39527 --- Comment #1 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 180348 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=180348&action=edit Bug 39527: Add action attribute to letter.pl form If not explicitly set, two 'op' parameters are sent, one with the value in the URL (add_form), one with the value in the form (cud-add_validate). This causes an error in the CSRF validation code under Mojolicious environment. Test plan: 1. Start staff interface as mojolicious application: `bin/intranet daemon -l http://*:3000/` 2. Go to http://localhost:3000 (replace localhost by the hostname where koha is running), log in, then go to Tools » Notices and slips. 3. Create a new notice. Without the patch it fails with the following message: Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-" With the patch it should succeed. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39527 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39527 Magnus Enger <magnus@libriotech.no> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39527 Magnus Enger <magnus@libriotech.no> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #180348|0 |1 is obsolete| | --- Comment #2 from Magnus Enger <magnus@libriotech.no> --- Created attachment 180667 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=180667&action=edit Bug 39527: Add action attribute to letter.pl form If not explicitly set, two 'op' parameters are sent, one with the value in the URL (add_form), one with the value in the form (cud-add_validate). This causes an error in the CSRF validation code under Mojolicious environment. Test plan: 1. Start staff interface as mojolicious application: `bin/intranet daemon -l http://*:3000/` 2. Go to http://localhost:3000 (replace localhost by the hostname where koha is running), log in, then go to Tools » Notices and slips. 3. Create a new notice. Without the patch it fails with the following message: Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-" With the patch it should succeed. Signed-off-by: Magnus Enger <magnus@libriotech.no> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39527 Magnus Enger <magnus@libriotech.no> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |magnus@libriotech.no --- Comment #3 from Magnus Enger <magnus@libriotech.no> --- To test in KTD I did this: $ sudo koha-plack --stop kohadev $ sudo service apache2 stop $ bin/intranet daemon -l http://*:8081/ -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39527 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |RESOLVED CC| |martin.renvoize@openfifth.c | |o.uk Resolution|--- |FIXED --- Comment #4 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- This was also inadvertently fixed in bug 39317 where we introduced the same change. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org