[Bug 38056] New: Search term after deleting an authority shouldn't be URI encoded
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38056 Bug ID: 38056 Summary: Search term after deleting an authority shouldn't be URI encoded Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P3 Component: MARC Authority data support Assignee: phil@chetcolibrary.org Reporter: phil@chetcolibrary.org QA Contact: testopia@bugs.koha-community.org Depends on: 34478 Prior to the CSRF protection, deleting an authority record from search results built up a URL for a GET, and used the uri TT filter on the value param, which is where the search term you used to find the record gets passed to the script for reloading afterward. That was fine (though the use of the html filter on the other params was a bit sketchy, given that they were being stuffed into a URL, not displayed as HTML), but when https://git.koha-community.org/Koha-community/Koha/commit/62d9f73e9e3bfe7fbc... switched from a GET to a form that POSTs, it retained the same escaping, so now we have a URI encoded value being put into a form input, passed over to the script which certainly isn't expecting that, and then stuffed back into the search box and searched for literally: if you do an authority search for "professional computing" and delete one of the results, the page that loads after the deletion is a search for "professional%20computing" Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 [Bug 34478] Full CSRF protection -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38056 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38056 --- Comment #1 from Phil Ringnalda <phil@chetcolibrary.org> --- Created attachment 172292 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=172292&action=edit Bug 38056: Search term after deleting an authority shouldn't be URI encoded Now that deleting an authority record uses a form, rather than building up a URL in JavaScript, using the filter | uri on the value (confusingly named value) which passes along the search terms to reload after deleting results in a bad search. It should instead use the filter | html. Test plan: 1. Without the patch, top menu - Authorities 2. The default search, Main heading ($a only), Authority type Default, Operator contains, Order by Heading A-Z will work fine. You need to a search which will return more than one of the same thing (not hard in ktd) - for MARC21 search for a professional 3. You should get five results. For one of them, Actions - Delete - Confirm that you meant to click it 4. You now have a%20professional in the search box, and search results for whatever ElasticSearch thinks a% means. It's certainly not professional - you can change that term to any random string and get the same results 5. Apply patch, top menu - Authorities 6. Repeat steps 2 and 3, but this time after deleting another result, you will get a professional without the %20 in the search box, and your results will be the remaining Addison-Wesley professional computing series authorities Sponsored-by: Chetco Community Public Library -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38056 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38056 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38056 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #172292|0 |1 is obsolete| | --- Comment #2 from David Nind <david@davidnind.com> --- Created attachment 173009 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=173009&action=edit Bug 38056: Search term after deleting an authority shouldn't be URI encoded Now that deleting an authority record uses a form, rather than building up a URL in JavaScript, using the filter | uri on the value (confusingly named value) which passes along the search terms to reload after deleting results in a bad search. It should instead use the filter | html. Test plan: 1. Without the patch, top menu - Authorities 2. The default search, Main heading ($a only), Authority type Default, Operator contains, Order by Heading A-Z will work fine. You need to a search which will return more than one of the same thing (not hard in ktd) - for MARC21 search for a professional 3. You should get five results. For one of them, Actions - Delete - Confirm that you meant to click it 4. You now have a%20professional in the search box, and search results for whatever ElasticSearch thinks a% means. It's certainly not professional - you can change that term to any random string and get the same results 5. Apply patch, top menu - Authorities 6. Repeat steps 2 and 3, but this time after deleting another result, you will get a professional without the %20 in the search box, and your results will be the remaining Addison-Wesley professional computing series authorities Sponsored-by: Chetco Community Public Library Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38056 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38056 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #173009|0 |1 is obsolete| | --- Comment #3 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 173017 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=173017&action=edit Bug 38056: Search term after deleting an authority shouldn't be URI encoded Now that deleting an authority record uses a form, rather than building up a URL in JavaScript, using the filter | uri on the value (confusingly named value) which passes along the search terms to reload after deleting results in a bad search. It should instead use the filter | html. Test plan: 1. Without the patch, top menu - Authorities 2. The default search, Main heading ($a only), Authority type Default, Operator contains, Order by Heading A-Z will work fine. You need to a search which will return more than one of the same thing (not hard in ktd) - for MARC21 search for a professional 3. You should get five results. For one of them, Actions - Delete - Confirm that you meant to click it 4. You now have a%20professional in the search box, and search results for whatever ElasticSearch thinks a% means. It's certainly not professional - you can change that term to any random string and get the same results 5. Apply patch, top menu - Authorities 6. Repeat steps 2 and 3, but this time after deleting another result, you will get a professional without the %20 in the search box, and your results will be the remaining Addison-Wesley professional computing series authorities Sponsored-by: Chetco Community Public Library Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38056 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |jonathan.druart@gmail.com |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38056 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |24.11.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38056 --- Comment #4 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.11! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38056 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |rel_24_05_candidate -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38056 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|rel_24_05_candidate | Status|Pushed to main |Pushed to stable CC| |lucas@bywatersolutions.com Version(s)|24.11.00 |24.11.00,24.05.05 released in| | --- Comment #5 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38056 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Pushed to stable |RESOLVED --- Comment #6 from Phil Ringnalda <phil@chetcolibrary.org> --- Depends on CSRF not in 23.11, and we for sure never documented what it fixed. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38056 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |maxeinergl@gcc.edu --- Comment #7 from Phil Ringnalda <phil@chetcolibrary.org> --- *** Bug 38435 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38056 Bug 38056 depends on bug 34478, which changed state. Bug 34478 Summary: Full CSRF protection https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org