[Bug 37612] New: Batch modifying patrons from patron lists broken by CSRF protection
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37612 Bug ID: 37612 Summary: Batch modifying patrons from patron lists broken by CSRF protection Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Tools Assignee: phil@chetcolibrary.org Reporter: phil@chetcolibrary.org QA Contact: testopia@bugs.koha-community.org Blocks: 36192 Patron lists have an Actions menuitem to Batch edit patrons, which sends a GET to tools/modborrowers.pl?patron_list_id=1&op=show. But because the other two ways to modborrowers are to upload a file of borrowernumbers or to stick a possibly-huge number of borrowernumbers into a textarea, both of which require a POST, the op is now cud-show, not because it does anything CUD, but because it has to accept POSTs. It just needs the same solution as https://git.koha-community.org/Koha-community/Koha/src/commit/99c2064126978f... to accept both cud-show and show. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37612 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37612 --- Comment #1 from Phil Ringnalda <phil@chetcolibrary.org> --- Created attachment 170223 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=170223&action=edit Bug 37612: Batch patron modification should accept both cud-show and show ops Just like with batch item modification, batch patron modification can accept either a POST of a lot of data, which might be more than Apache's default URL length limit, or a GET of a little data. Or at least it could, if both the op 'cud-show' and the op 'show' were accepted. Show isn't doing any creation or updating or deleting, it just has to be cud-show because it needs to be able to accept large POSTs. So when it is only getting a little data, it should be willing to take a GET with op=show just like batch item modification does. Test plan: 1. Tools - Patron lists - New patron list - give it a name and Save 2. Type enough characters in the Patron search input to find a patron (I like ace for poor often-used Henry Acevedo) 3. Add patrons 4. Return to Patron lists, and in the Actions menu for your list, choose Batch edit patrons. Note that the page that loads doesn't show any patrons or UI to edit them, only a message about "No patron card numbers or borrowernumbers given." 5. Apply patch, restart_all 6. Repeat step 4, but this time get a page with your patron listed, and a form to change things about the patron record. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37612 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #170223|0 |1 is obsolete| | --- Comment #2 from Phil Ringnalda <phil@chetcolibrary.org> --- Created attachment 170459 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=170459&action=edit Bug 37612: Batch patron modification should accept both cud-show and show ops Just like with batch item modification, batch patron modification can accept either a POST of a lot of data, which might be more than Apache's default URL length limit, or a GET of a little data. Or at least it could, if both the op 'cud-show' and the op 'show' were accepted. Show isn't doing any creation or updating or deleting, it just has to be cud-show because it needs to be able to accept large POSTs. So when it is only getting a little data, it should be willing to take a GET with op=show just like batch item modification does. Test plan: 1. Without the patch, Tools - Patron lists - New patron list - give it a name and Save 2. Type enough characters in the Patron search input to find a patron (I like ace for poor often-used Henry Acevedo) and click on a patron in the list of results 3. Click Add patrons 4. Click Patron lists, and in the Actions menu for your list, choose Batch edit patrons. Note that the page that loads doesn't show any patrons or UI to edit them, only a message about "No patron card numbers or borrowernumbers given." 5. Apply patch, restart_all 6. Repeat step 4, but this time get a page with your patron listed, and a form to change things about the patron record. Sponsored-by: Chetco Community Public Library -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37612 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37612 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #170459|0 |1 is obsolete| | --- Comment #3 from David Nind <david@davidnind.com> --- Created attachment 170462 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=170462&action=edit Bug 37612: Batch patron modification should accept both cud-show and show ops Just like with batch item modification, batch patron modification can accept either a POST of a lot of data, which might be more than Apache's default URL length limit, or a GET of a little data. Or at least it could, if both the op 'cud-show' and the op 'show' were accepted. Show isn't doing any creation or updating or deleting, it just has to be cud-show because it needs to be able to accept large POSTs. So when it is only getting a little data, it should be willing to take a GET with op=show just like batch item modification does. Test plan: 1. Without the patch, Tools - Patron lists - New patron list - give it a name and Save 2. Type enough characters in the Patron search input to find a patron (I like ace for poor often-used Henry Acevedo) and click on a patron in the list of results 3. Click Add patrons 4. Click Patron lists, and in the Actions menu for your list, choose Batch edit patrons. Note that the page that loads doesn't show any patrons or UI to edit them, only a message about "No patron card numbers or borrowernumbers given." 5. Apply patch, restart_all 6. Repeat step 4, but this time get a page with your patron listed, and a form to change things about the patron record. Sponsored-by: Chetco Community Public Library Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37612 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com Text to go in the| |This fixes batch editing release notes| |patrons from a patron list | |(Tools > Patrons and | |circulation > Patron lists | |> Actions > Batch edit | |patrons). When attempting | |to batch edit patrons, it | |didn't load the page to | |batch edit the patrons, and | |displayed the message "No | |patron card numbers or | |borrowernumbers given." | |(This is related to the | |CSRF changes added in Koha | |24.05 to improve form | |security.) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37612 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=37614 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37612 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #4 from David Cook <dcook@prosentient.com.au> --- This sounds all right. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37612 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #170462|0 |1 is obsolete| | --- Comment #5 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 170528 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=170528&action=edit Bug 37612: Batch patron modification should accept both cud-show and show ops Just like with batch item modification, batch patron modification can accept either a POST of a lot of data, which might be more than Apache's default URL length limit, or a GET of a little data. Or at least it could, if both the op 'cud-show' and the op 'show' were accepted. Show isn't doing any creation or updating or deleting, it just has to be cud-show because it needs to be able to accept large POSTs. So when it is only getting a little data, it should be willing to take a GET with op=show just like batch item modification does. Test plan: 1. Without the patch, Tools - Patron lists - New patron list - give it a name and Save 2. Type enough characters in the Patron search input to find a patron (I like ace for poor often-used Henry Acevedo) and click on a patron in the list of results 3. Click Add patrons 4. Click Patron lists, and in the Actions menu for your list, choose Batch edit patrons. Note that the page that loads doesn't show any patrons or UI to edit them, only a message about "No patron card numbers or borrowernumbers given." 5. Apply patch, restart_all 6. Repeat step 4, but this time get a page with your patron listed, and a form to change things about the patron record. Sponsored-by: Chetco Community Public Library Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37612 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA QA Contact|testopia@bugs.koha-communit |martin.renvoize@ptfs-europe |y.org |.com CC| |martin.renvoize@ptfs-europe | |.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37612 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |24.11.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37612 --- Comment #6 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.11! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37612 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |rel_24_05_candidate -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37612 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|24.11.00 |24.11.00,24.05.04 released in| | Status|Pushed to main |Pushed to stable CC| |lucas@bywatersolutions.com Keywords|rel_24_05_candidate | --- Comment #7 from Lucas Gass <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.04 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37612 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Status|Pushed to stable |Needs documenting --- Comment #8 from Fridolin Somers <fridolin.somers@biblibre.com> --- Not for 23.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37612 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED Resolution|--- |FIXED --- Comment #9 from David Nind <david@davidnind.com> --- This fixes a bug - no interface changes, so no updates to the manual required. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org