[Bug 36193] New: CSRF - Code review missed
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 Bug ID: 36193 Summary: CSRF - Code review missed Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: nick@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org This bug is for tracking follow-ups missed in the initial review. Please see the "Code review missed" section on the framapad here: https://annuel.framapad.org/p/koha_34478_remaining Additional entries can be added there, and should be crossed out when completed Patches should be attached here This bug can be closed when that section of the pad is empty -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |36192 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #1 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 162684 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162684&action=edit Bug 36193: Add more request information on Koha::Middleware::CSRF output Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #2 from David Cook <dcook@prosentient.com.au> --- I'm not sure if I fully understand. It looks like bug 34478 accidentally broke the Oauth/OIDC SSO, so I've fixed it on bug 36219. Should I have added that patch here instead? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #3 from Nick Clemens <nick@bywatersolutions.com> --- (In reply to David Cook from comment #2)
I'm not sure if I fully understand. It looks like bug 34478 accidentally broke the Oauth/OIDC SSO, so I've fixed it on bug 36219. Should I have added that patch here instead?
The idea was simply to reduce the number of bugs filed, for what will likely be similar patches - it is perfectly okay that you filed a new bug, and it is for a distinct issue, and you linked it to the others. This is going to be a bit messy, so we just do our best to keep things clear and simple, and I think you did. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #4 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 162733 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162733&action=edit Bug 36193: Fix acq receiving This patch addresses the CSRF error when receiving in acquisitions. To test: 1. Have at least one order to receive 2. Follow the steps to receive them 3. Have the logs open: $ ktd --shell k$ tail -f /var/log/koha/kohadev/*.log 4. Click to confirm receipt => FAIL: An error modal is displayed => FAIL: There's an error about missing CSRF token in POST 5. Apply this patch 6. Reload everything: k$ restart_all 7. Repeat 1-4 => SUCCESS: Receipt works :-D => SUCCESS: No error log 8. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #5 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 162734 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162734&action=edit Bug 36193: cud- treatment for Acq order receipt cancelling Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #6 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 162749 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162749&action=edit Bug 36193: cud- treatment for cash_registers.pl Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #7 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 162750 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162750&action=edit Bug 36193: cud- treatment for credit_types.pl Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #8 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 162751 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162751&action=edit Bug 36193: cud- treatment for dedit_types.pl Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #9 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 162752 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162752&action=edit Bug 36193: cud- treatment for reset_confirmed on mappings.pl Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #10 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 162755 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162755&action=edit Bug 36193: cud- treatment for restrictions.pl Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #162684|0 |1 is obsolete| | Attachment #162733|0 |1 is obsolete| | Attachment #162734|0 |1 is obsolete| | Attachment #162749|0 |1 is obsolete| | Attachment #162750|0 |1 is obsolete| | Attachment #162751|0 |1 is obsolete| | Attachment #162752|0 |1 is obsolete| | Attachment #162755|0 |1 is obsolete| | --- Comment #11 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 162769 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162769&action=edit Bug 36193: Add more request information on Koha::Middleware::CSRF output Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #12 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 162770 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162770&action=edit Bug 36193: Fix acq receiving This patch addresses the CSRF error when receiving in acquisitions. To test: 1. Have at least one order to receive 2. Follow the steps to receive them 3. Have the logs open: $ ktd --shell k$ tail -f /var/log/koha/kohadev/*.log 4. Click to confirm receipt => FAIL: An error modal is displayed => FAIL: There's an error about missing CSRF token in POST 5. Apply this patch 6. Reload everything: k$ restart_all 7. Repeat 1-4 => SUCCESS: Receipt works :-D => SUCCESS: No error log 8. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #13 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 162771 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162771&action=edit Bug 36193: cud- treatment for Acq order receipt cancelling Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #14 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 162772 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162772&action=edit Bug 36193: cud- treatment for cash_registers.pl Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #15 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 162773 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162773&action=edit Bug 36193: cud- treatment for credit_types.pl Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #16 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 162774 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162774&action=edit Bug 36193: cud- treatment for dedit_types.pl Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #17 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 162775 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162775&action=edit Bug 36193: cud- treatment for reset_confirmed on mappings.pl Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #18 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 162776 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162776&action=edit Bug 36193: cud- treatment for restrictions.pl Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #19 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 162777 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162777&action=edit Bug 36193: (follow-up) Use buttons and don't nest forms When changing action links into forms, we should use a submit button rather than JS to submit Receipt cancelling needed a form embedded in the page as we cannot nest forms Fixed searching on invoice.pl Fixed resetting mappings (original button did not need cud-) Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #162777|0 |1 is obsolete| | --- Comment #20 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 162784 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162784&action=edit Bug 36193: (follow-up) Use buttons and don't nest forms When changing action links into forms, we should use a submit button rather than JS to submit Receipt cancelling needed a form embedded in the page as we cannot nest forms Fixed searching on invoice.pl Fixed resetting mappings (original button did not need cud-) Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #21 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 162830 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162830&action=edit Bug 36193: Make restore icon consistent in cash registers Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #22 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 162831 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162831&action=edit Bug 36193: cud- treatment for catalogue/stockrotation.pl Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #23 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 162837 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162837&action=edit Bug 36193: cud- treatment for tools/stockrotation.pl Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #24 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed all these to master. Handling is a little big finicky. I'd prefer separate bugs from now on if that's OK. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |24.05.00 released in| | Status|Passed QA |Pushed to master -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 --- Comment #25 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.05! Well done everyone, thank you! -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m --- Comment #26 from Fridolin Somers <fridolin.somers@biblibre.com> --- Depends on Bug 34478 no ? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |34478 --- Comment #27 from David Cook <dcook@prosentient.com.au> --- (In reply to Fridolin Somers from comment #26)
Depends on Bug 34478 no ?
Yep. I've just added it as a dependency. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 [Bug 34478] Full CSRF protection -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to master |RESOLVED Resolution|--- |FIXED --- Comment #28 from Fridolin Somers <fridolin.somers@biblibre.com> --- Depends on Bug 34478 not in 23.11.x -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 Bug 36193 depends on bug 34478, which changed state. Bug 34478 Summary: Full CSRF protection https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org