[Bug 37614] New: Printing patron cards from patron lists broken by CSRF protection
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37614 Bug ID: 37614 Summary: Printing patron cards from patron lists broken by CSRF protection Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Tools Assignee: koha-bugs@lists.koha-community.org Reporter: phil@chetcolibrary.org QA Contact: testopia@bugs.koha-community.org CC: jonathan.druart@gmail.com, oleonard@myacpl.org Blocks: 36192 Steps to reproduce: 1. Tools - Patrons lists, if you don't already have one then New list, name and save, Search for patrons, add at least one patron, then return to Patron lists. 2. In the Actions menu for your patron list, select Print patron cards 3. In that perfectly normal looking popup, click Export. You now have a popup with an Loading throbber, which will hang forever, and in your console you have a 403 error from trying to GET patroncards/print.pl. If you go back and inspect the page where you clicked Export, you'll find that it is a button type='submit' in a form with method='post' which makes the GET seem a bit odd. To see that it sometimes posts, 1. Tools - Patron card creator - New card batch - Add at least one patron 2. Export card batch 3. You get a popup with a lovely Windows 95 aesthetic courtesy of greybox.inc, but it is that same form method='post' with the same type='submit' Export button. Click Export and you will POST to patroncards/print.pl and things will work just fine. Not at all clear to me how opening the popup one way turns the POST to a GET, but it does. There's a FIXME in patroncards/print.pl saying that the op=cud-export looks sus, which it does. You could try to make the case that it's sensible to POST because in the case where you have selected some but not all of the patrons in a label batch, the number of label_id params in the URL could be so high that it exceeds Apache's max URL length, but then the result of the POST is a link to create the PDF that is the actual "print" export, and that link is a GET which contains all of them with an over-escaped &label_id= param for each one. So a pragmatic fix would be to just change from a POST to a GET, change cud-export to export, and not worry about why called one way it POSTs and called another way it GETs. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37614 --- Comment #1 from Phil Ringnalda <phil@chetcolibrary.org> --- Oh, it's a GET because the entire popup <div> (where I never would have looked for a handler) has an onsubmit handler which cancels the submit, drags the fields out of the form, stuffs them in a query string, and GETs the .action URL with it. https://git.koha-community.org/Koha-community/Koha/src/commit/52dccfe27beec8... That's... something. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37614 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37614 --- Comment #2 from Phil Ringnalda <phil@chetcolibrary.org> --- Created attachment 170416 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=170416&action=edit Bug 37614: Printing patron cards from patron lists should be a GET There's no creating, updating, or deleting about printing patron cards, and the only time there's a lot of data (selecting individual patrons in a card creator batch), it doesn't matter if the "Export selected" URL exceeds the maxlength for Apache since the actual link to create the PDF also will. Test plan: 1. Without the patch, Tools - Patron lists - New patron list - Name it and Save 2. Type three characters in the Patron search form (mar works well) to get at least three patrons. Click on each of three, then click Add patrons 3. You can only print cards from the list of lists, so back to Tools - Patron lists 4. In the Actions menu choose Print patron cards, in the popup click Export 5. Watch the throbber spin around for a while (it will never stop), then close the popup, apply the patch, restart_all 6. Tools - Patron lists - Actions menu - Print patron cards - Export 7. Click the PDF link, make sure it has all three of your patrons 8. Tools - Patron card creator - New - Card batch 9. Without putting anything in the textarea, click Add patrons, in the search popup search for your three characters (mar) again, and click the checkboxes to the left of three of the names, then Add selected patrons, then Close, then Add patrons 10. Click the checkboxes for two of the three patrons, then Export selected card(s), then Export in the popup 11. Hover the link to the PDF, verify that it doesn't have stray 'amp;' after the & and before label_id= anymore 12. Click the PDF link, verify it has your two patrons 13. Back at the card batch, click Export card batch, then Export 14. Check the PDF to verify it has all three of your patrons 15. Tools - Patron lists - click your list's name to open it 16. Click the card number for a patron, then the Patron lists tab in Checkout 17. Actions menu - Print patron cards - Export, verify the PDF has all three patrons -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37614 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |phil@chetcolibrary.org |ity.org | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37614 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37614 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #170416|0 |1 is obsolete| | --- Comment #3 from David Nind <david@davidnind.com> --- Created attachment 170417 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=170417&action=edit Bug 37614: Printing patron cards from patron lists should be a GET There's no creating, updating, or deleting about printing patron cards, and the only time there's a lot of data (selecting individual patrons in a card creator batch), it doesn't matter if the "Export selected" URL exceeds the maxlength for Apache since the actual link to create the PDF also will. Test plan: 1. Without the patch, Tools - Patron lists - New patron list - Name it and Save 2. Type three characters in the Patron search form (mar works well) to get at least three patrons. Click on each of three, then click Add patrons 3. You can only print cards from the list of lists, so back to Tools - Patron lists 4. In the Actions menu choose Print patron cards, in the popup click Export 5. Watch the throbber spin around for a while (it will never stop), then close the popup, apply the patch, restart_all 6. Tools - Patron lists - Actions menu - Print patron cards - Export 7. Click the PDF link, make sure it has all three of your patrons 8. Tools - Patron card creator - New - Card batch 9. Without putting anything in the textarea, click Add patrons, in the search popup search for your three characters (mar) again, and click the checkboxes to the left of three of the names, then Add selected patrons, then Close, then Add patrons 10. Click the checkboxes for two of the three patrons, then Export selected card(s), then Export in the popup 11. Hover the link to the PDF, verify that it doesn't have stray 'amp;' after the & and before label_id= anymore 12. Click the PDF link, verify it has your two patrons 13. Back at the card batch, click Export card batch, then Export 14. Check the PDF to verify it has all three of your patrons 15. Tools - Patron lists - click your list's name to open it 16. Click the card number for a patron, then the Patron lists tab in Checkout 17. Actions menu - Print patron cards - Export, verify the PDF has all three patrons Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37614 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com --- Comment #4 from David Nind <david@davidnind.com> --- I've signed off, however I think step 17 needs fixing. With the patch applied, when you select Actions > Print patron cards, the export page and results from selecting 'Export' are not in a pop-up window. This is how it works on main as well. However, I think this needs fixing - maybe as a separate bug if you don't want to fix it here? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37614 --- Comment #5 from Phil Ringnalda <phil@chetcolibrary.org> --- Very much a separate bug, thanks. I'd like to let someone who thinks it's a good idea to have UI to print a whole batch of patron cards while checking out to one patron in the list decide what that UI should look like. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37614 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37614 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #170417|0 |1 is obsolete| | --- Comment #6 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 170422 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=170422&action=edit Bug 37614: Printing patron cards from patron lists should be a GET There's no creating, updating, or deleting about printing patron cards, and the only time there's a lot of data (selecting individual patrons in a card creator batch), it doesn't matter if the "Export selected" URL exceeds the maxlength for Apache since the actual link to create the PDF also will. Test plan: 1. Without the patch, Tools - Patron lists - New patron list - Name it and Save 2. Type three characters in the Patron search form (mar works well) to get at least three patrons. Click on each of three, then click Add patrons 3. You can only print cards from the list of lists, so back to Tools - Patron lists 4. In the Actions menu choose Print patron cards, in the popup click Export 5. Watch the throbber spin around for a while (it will never stop), then close the popup, apply the patch, restart_all 6. Tools - Patron lists - Actions menu - Print patron cards - Export 7. Click the PDF link, make sure it has all three of your patrons 8. Tools - Patron card creator - New - Card batch 9. Without putting anything in the textarea, click Add patrons, in the search popup search for your three characters (mar) again, and click the checkboxes to the left of three of the names, then Add selected patrons, then Close, then Add patrons 10. Click the checkboxes for two of the three patrons, then Export selected card(s), then Export in the popup 11. Hover the link to the PDF, verify that it doesn't have stray 'amp;' after the & and before label_id= anymore 12. Click the PDF link, verify it has your two patrons 13. Back at the card batch, click Export card batch, then Export 14. Check the PDF to verify it has all three of your patrons 15. Tools - Patron lists - click your list's name to open it 16. Click the card number for a patron, then the Patron lists tab in Checkout 17. Actions menu - Print patron cards - Export, verify the PDF has all three patrons Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37614 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy@rijksmuseum.nl QA Contact|testopia@bugs.koha-communit |m.de.rooy@rijksmuseum.nl |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37614 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |24.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37614 --- Comment #7 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.11! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37614 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This fixes printing patron release notes| |cards from a patron list | |(Tools > Patrons and | |circulation > Patron lists | |> Actions > Print patron | |cards > Export). When | |clicking on Export, the | |progress icon keeps | |spinning and doesn't finish | |- resulting in no PDF file | |to download. (This is | |related to the CSRF changes | |added in Koha 24.05 to | |improve form security.) See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=37612 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37614 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com Version(s)|24.11.00 |24.11.00,24.05.04 released in| | Status|Pushed to main |Pushed to stable --- Comment #8 from Lucas Gass <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.04 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37614 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting CC| |fridolin.somers@biblibre.co | |m --- Comment #9 from Fridolin Somers <fridolin.somers@biblibre.com> --- Not for 23.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37614 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Needs documenting |RESOLVED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org