[Bug 36630] New: Item search batch operations buttons broken by CRSF
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36630 Bug ID: 36630 Summary: Item search batch operations buttons broken by CRSF Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Cataloging Assignee: koha-bugs@lists.koha-community.org Reporter: blawlor@clamsnet.org QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl Since Bug 34478 Full CSRF protection some POST requests return 403 with an error and need to be ajusted. On the Item search results page, the Batch operations buttons are broken and need to be changed to GET. To recreate: 1. Do an item search 2. On the results page 'click Select visible rows' 3. Click 'Batch operations' and select 'Batch item modification' 4. See Programming error - op 'show' must start with 'cud-' for POST http://localhost:8081/intranet/tools/batchMod.pl (referer: http://localhost:8081/cgi-bin/koha/catalogue/itemsearch.pl) 5. Click 'Batch operations' and select 'Batch item deletion' 6. See the same error -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36630 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |blawlor@clamsnet.org |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36630 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36630 --- Comment #1 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 165034 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=165034&action=edit Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons This patch changes the form that submits to batchMod.pl from the Item search results page. The form method does not need to be a POST. To recreate: 1. Do an item search 2. On the results page 'click Select visible rows' 3. Click 'Batch operations' and select 'Batch item modification' 4. See Programming error - op 'show' must start with 'cud-' for POST http://localhost:8081/intranet/tools/batchMod.pl (referer: http://localhost:8081/cgi-bin/koha/catalogue/itemsearch.pl) 5. Click 'Batch operations' and select 'Batch item deletion' 6. See the same error To test: 1. Apply patch and repeat steps to recreate the issue 2. See that the batchMod.pl page loads with no error. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36630 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |34478 Blocks| |36192 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 [Bug 34478] Full CSRF protection https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36630 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36630 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #165034|0 |1 is obsolete| | --- Comment #2 from David Nind <david@davidnind.com> --- Created attachment 165035 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=165035&action=edit Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons This patch changes the form that submits to batchMod.pl from the Item search results page. The form method does not need to be a POST. To recreate: 1. Do an item search 2. On the results page 'click Select visible rows' 3. Click 'Batch operations' and select 'Batch item modification' 4. See Programming error - op 'show' must start with 'cud-' for POST http://localhost:8081/intranet/tools/batchMod.pl (referer: http://localhost:8081/cgi-bin/koha/catalogue/itemsearch.pl) 5. Click 'Batch operations' and select 'Batch item deletion' 6. See the same error To test: 1. Apply patch and repeat steps to recreate the issue 2. See that the batchMod.pl page loads with no error. Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36630 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36630 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #165035|0 |1 is obsolete| | --- Comment #3 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 165036 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=165036&action=edit Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons This patch changes the form that submits to batchMod.pl from the Item search results page. The form method does not need to be a POST. To recreate: 1. Do an item search 2. On the results page 'click Select visible rows' 3. Click 'Batch operations' and select 'Batch item modification' 4. See Programming error - op 'show' must start with 'cud-' for POST http://localhost:8081/intranet/tools/batchMod.pl (referer: http://localhost:8081/cgi-bin/koha/catalogue/itemsearch.pl) 5. Click 'Batch operations' and select 'Batch item deletion' 6. See the same error To test: 1. Apply patch and repeat steps to recreate the issue 2. See that the batchMod.pl page loads with no error. Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36630 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |24.05.00 released in| | Status|Passed QA |Pushed to master -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36630 --- Comment #4 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36630 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED CC| |fridolin.somers@biblibre.co | |m Status|Pushed to main |RESOLVED --- Comment #5 from Fridolin Somers <fridolin.somers@biblibre.com> --- Depends on Bug 34478 not in 23.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36630 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Item search batch |Item search batch |operations buttons broken |operations buttons broken |by CRSF |by CSRF -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36630 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |38413 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38413 [Bug 38413] Batch operations from item search results fail when "select visible rows" and many items are selected -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36630 Bug 36630 depends on bug 34478, which changed state. Bug 34478 Summary: Full CSRF protection https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org