[Bug 37827] New: Switch OPAC download list form from POST to GET
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37827 Bug ID: 37827 Summary: Switch OPAC download list form from POST to GET Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P3 Component: OPAC Assignee: phil@chetcolibrary.org Reporter: phil@chetcolibrary.org QA Contact: testopia@bugs.koha-community.org Depends on: 36192 Blocks: 37728 We meant to not have any forms that post without an op starting with cud-, but because of bug 37728 we missed a few, like the hidden form to download a list in the OPAC. There's no visible reason why it even needs a form to submit, rather than just having the menu be a list of links the way the staff client does it, but that's a problem for another bug. Here, we just need to switch it from a post to a get, so we can land the fix to the test for things posting without a cud- op. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37728 [Bug 37728] More "op" are missing in POSTed forms -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37827 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37827 --- Comment #1 from Phil Ringnalda <phil@chetcolibrary.org> --- Created attachment 171008 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=171008&action=edit Bug 37827: Switch OPAC download list form from POST to GET The hidden form that the OPAC uses for downloading a list has no need to be a POST, which is good because it can't be one without having an op param that starts with "cud-" which it doesn't have. Test plan: 1. Nothing visible will change, so start with the patch applied 2. Log in to the OPAC, then do a search for something like Perl which will return a couple of results. Select two, With selected titles: Add to list - New list - give it a name and Save 3. Lists - choose the one you just created 4. Download - ISBD 5. Verify that the page you were on didn't change, that a file was downloaded, and that the file contains the two titles in your list Sponsored-by: Chetco Community Public Library -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37827 Chloe Zermatten <chloe.zermatten@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #171008|0 |1 is obsolete| | --- Comment #2 from Chloe Zermatten <chloe.zermatten@ptfs-europe.com> --- Created attachment 171016 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=171016&action=edit Bug 37827: Switch OPAC download list form from POST to GET The hidden form that the OPAC uses for downloading a list has no need to be a POST, which is good because it can't be one without having an op param that starts with "cud-" which it doesn't have. Test plan: 1. Nothing visible will change, so start with the patch applied 2. Log in to the OPAC, then do a search for something like Perl which will return a couple of results. Select two, With selected titles: Add to list - New list - give it a name and Save 3. Lists - choose the one you just created 4. Download - ISBD 5. Verify that the page you were on didn't change, that a file was downloaded, and that the file contains the two titles in your list Sponsored-by: Chetco Community Public Library Signed-off-by: Chloe Zermatten <chloe.zermatten@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37827 Chloe Zermatten <chloe.zermatten@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off CC| |chloe.zermatten@ptfs-europe | |.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37827 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37827 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #171016|0 |1 is obsolete| | --- Comment #3 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 171325 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=171325&action=edit Bug 37827: Switch OPAC download list form from POST to GET The hidden form that the OPAC uses for downloading a list has no need to be a POST, which is good because it can't be one without having an op param that starts with "cud-" which it doesn't have. Test plan: 1. Nothing visible will change, so start with the patch applied 2. Log in to the OPAC, then do a search for something like Perl which will return a couple of results. Select two, With selected titles: Add to list - New list - give it a name and Save 3. Lists - choose the one you just created 4. Download - ISBD 5. Verify that the page you were on didn't change, that a file was downloaded, and that the file contains the two titles in your list Sponsored-by: Chetco Community Public Library Signed-off-by: Chloe Zermatten <chloe.zermatten@ptfs-europe.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37827 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |jonathan.druart@gmail.com |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37827 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |24.11.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37827 --- Comment #4 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.11! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37827 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable Version(s)|24.11.00 |24.11.00,24.05.06 released in| | CC| |lucas@bywatersolutions.com --- Comment #5 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.06 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37827 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting CC| |fridolin.somers@biblibre.co | |m --- Comment #6 from Fridolin Somers <fridolin.somers@biblibre.com> --- Not for 23.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37827 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Needs documenting |RESOLVED --- Comment #7 from Phil Ringnalda <phil@chetcolibrary.org> --- Nothing to document, just an invisible bugfix. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37827 Bug 37827 depends on bug 36192, which changed state. Bug 36192 Summary: [OMNIBUS] CSRF Protection for Koha https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org