[Bug 37089] New: Cannot delete a fund or a currency
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37089 Bug ID: 37089 Summary: Cannot delete a fund or a currency Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Acquisitions Assignee: emily.lamancusa@montgomerycountymd.gov Reporter: emily.lamancusa@montgomerycountymd.gov QA Contact: testopia@bugs.koha-community.org Blocks: 36192 aqbudgets.pl and currency.pl are looking for op=cud-delete_confirm, but delete_confirm isn't CUD and the page is just a GET displaying the information. To reproduce: Part 1 - Delete a fund 1. Go to Acquisitions > Funds 2. Try to delete a fund --> Confirmation page shows fund name as '' and fund amount as 0.00 3. Click "Yes, delete this fund" --> The fund is still there Part 2 - Delete a currency 1. Go to Acquisitions > Currencies 2. Try to delete a currency --> Confirmation shows empty values for currency and rate 3. Click, "Yes, delete this currency" --> An error message appears and the currency is not deleted Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37089 --- Comment #1 from Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> --- Created attachment 167715 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167715&action=edit Bug 37089: cud-delete_confirm should not be cud Adjust aqbudgets.pl and currency.pl to check for the correct op value To test: Part 1 - Delete a fund 1. Go to Acquisitions > Funds 2. Try to delete a fund --> Confirmation page shows fund name as '' and fund amount as 0.00 3. Click "Yes, delete this fund" --> The fund is still there Part 2 - Delete a currency 3. Go to Acquisitions > Currencies 4. Try to delete a currency --> Confirmation shows empty values for currency and rate 5. Click, "Yes, delete this currency" --> An error message appears and the currency is not deleted 6. Apply patch and restart_all 7. Repeat steps 1-5 --> Confirmation pages display correct information, and deletions occur successfully -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37089 Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37089 Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=37090 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37089 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37089 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167715|0 |1 is obsolete| | --- Comment #2 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 167717 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167717&action=edit Bug 37089: cud-delete_confirm should not be cud Adjust aqbudgets.pl and currency.pl to check for the correct op value To test: Part 1 - Delete a fund 1. Go to Acquisitions > Funds 2. Try to delete a fund --> Confirmation page shows fund name as '' and fund amount as 0.00 3. Click "Yes, delete this fund" --> The fund is still there Part 2 - Delete a currency 3. Go to Acquisitions > Currencies 4. Try to delete a currency --> Confirmation shows empty values for currency and rate 5. Click, "Yes, delete this currency" --> An error message appears and the currency is not deleted 6. Apply patch and restart_all 7. Repeat steps 1-5 --> Confirmation pages display correct information, and deletions occur successfully Signed-off-by: Owen Leonard <oleonard@myacpl.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37089 Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=37091 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37089 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com QA Contact|testopia@bugs.koha-communit |lucas@bywatersolutions.com |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37089 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37089 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167717|0 |1 is obsolete| | --- Comment #3 from Lucas Gass <lucas@bywatersolutions.com> --- Created attachment 167751 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167751&action=edit Bug 37089: cud-delete_confirm should not be cud Adjust aqbudgets.pl and currency.pl to check for the correct op value To test: Part 1 - Delete a fund 1. Go to Acquisitions > Funds 2. Try to delete a fund --> Confirmation page shows fund name as '' and fund amount as 0.00 3. Click "Yes, delete this fund" --> The fund is still there Part 2 - Delete a currency 3. Go to Acquisitions > Currencies 4. Try to delete a currency --> Confirmation shows empty values for currency and rate 5. Click, "Yes, delete this currency" --> An error message appears and the currency is not deleted 6. Apply patch and restart_all 7. Repeat steps 1-5 --> Confirmation pages display correct information, and deletions occur successfully Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37089 --- Comment #4 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- It looks like we still got quite a few of "cud-delete-confirm" - should we check those systematically? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37089 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |24.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37089 --- Comment #5 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.11! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37089 --- Comment #6 from Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> --- (In reply to Katrin Fischer from comment #4)
It looks like we still got quite a few of "cud-delete-confirm" - should we check those systematically?
I agree! That was my goal here as well. :) I actually do have a list that I've been working through (pulled by git grep). The others will take a bit more attention because they *don't* seem to break functionality. I just filed bug 37152 with the list and what I've tested so far. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37089 --- Comment #7 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to Emily Lamancusa from comment #6)
(In reply to Katrin Fischer from comment #4)
It looks like we still got quite a few of "cud-delete-confirm" - should we check those systematically?
I agree! That was my goal here as well. :) I actually do have a list that I've been working through (pulled by git grep). The others will take a bit more attention because they *don't* seem to break functionality. I just filed bug 37152 with the list and what I've tested so far.
Awesome, thanks Emily! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37089 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable Version(s)|24.11.00 |24.11.00,24.05.02 released in| | --- Comment #8 from Lucas Gass <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.02 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37089 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting CC| |fridolin.somers@biblibre.co | |m --- Comment #9 from Fridolin Somers <fridolin.somers@biblibre.com> --- Full CSRF not in 23.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37089 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com Text to go in the| |This fixes the acquisitions release notes| |funds and currencies pages | |so that they can be | |deleted. After the CSRF | |changes in 24.05 to improve | |form security, the 'Delete' | |actions no longer worked. | |The deletion confirmation | |message was displayed with | |'' for the name and no | |values for the fund or | |currency, then didn't | |delete them. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37089 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Needs documenting |RESOLVED --- Comment #10 from David Nind <david@davidnind.com> --- No changes to the manual required - this fixes something that was not working. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon@bugs.koha-community.org