[Bug 37192] New: The item editor Action menu Print label fails because the op to add to a label batch is now cud-add
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Bug ID: 37192 Summary: The item editor Action menu Print label fails because the op to add to a label batch is now cud-add Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Keywords: regression Severity: major Priority: P5 - low Component: Label/patron card printing Assignee: cnighswonger@foundations.edu Reporter: phil@chetcolibrary.org QA Contact: testopia@bugs.koha-community.org CC: isabel.pineda@ds.edu.sv Depends on: 36192 Steps to reproduce: 1. Search the catalog for anything with results, click Edit items on any bib with an existing item. 2. Click the Actions menu at the left of any item, select Print label That 500 error you just saw happened because the Print label action opens a popup at /cgi-bin/koha/labels/label-edit-batch.pl?op=add&number_type=itemnumber&number_list=633 which used to create a new label batch with that item in it, but now falls through the code past the "$op eq cud-add" because other parts of the label batch UI want to POST things to add so the op changed to cud-add, and the attempt to add winds up in code that thinks you are editing an existing batch, and makes crashing assumptions about what will be defined. Given that we don't believe that creating a label batch is worthy of CSRF protection, and we don't believe that removing an item from an existing batch is worthy of CSRF protection, I would argue that we should just make the if for add be elsif ($op eq 'cud-add' || $op eq 'add') rather than go through all the gyrations necessary to open a popup and have it immediately and silently POST a form just to add an item to a newly created batch. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 --- Comment #1 from Phil Ringnalda <phil@chetcolibrary.org> --- Created attachment 168117 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168117&action=edit Bug 37192: Make label printing from the item editor work by accepting the op add Some parts of the UI for adding items to a label batch (and there's lots of different UI to do it) want to POST items to add to a batch, so CSRF protection switched the op to add an item to cud-add. However, the item editor needs to create a batch of one from its Actions menu by just opening a popup, so it wants to GET ?op=add. Accepting both ops will keep all the variety of UIs happy. Test plan: 1. Search the catalog for something that will return results, like Perl 2. On any bib that has at least one item, click Edit items 3. In the Actions menu to the left of any item, choose Print label 4. That opened a popup with a 500 error rather than a label batch editor 5. Apply patch, restart_all 6. Repeat step 3, but this time you'll get a label batch editor with your item in it. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|cnighswonger@foundations.ed |phil@chetcolibrary.org |u | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Eric Garcia <cubingguy714@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Eric Garcia <cubingguy714@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168117|0 |1 is obsolete| | --- Comment #2 from Eric Garcia <cubingguy714@gmail.com> --- Created attachment 168151 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168151&action=edit Bug 37192: Make label printing from the item editor work by accepting the op add Some parts of the UI for adding items to a label batch (and there's lots of different UI to do it) want to POST items to add to a batch, so CSRF protection switched the op to add an item to cud-add. However, the item editor needs to create a batch of one from its Actions menu by just opening a popup, so it wants to GET ?op=add. Accepting both ops will keep all the variety of UIs happy. Test plan: 1. Search the catalog for something that will return results, like Perl 2. On any bib that has at least one item, click Edit items 3. In the Actions menu to the left of any item, choose Print label 4. That opened a popup with a 500 error rather than a label batch editor 5. Apply patch, restart_all 6. Repeat step 3, but this time you'll get a label batch editor with your item in it. Signed-off-by: Eric Garcia <cubingguy714@gmail.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|The item editor Action menu |Can't print label from the |Print label fails because |item editor |the op to add to a label | |batch is now cud-add | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com, | |m.de.rooy@rijksmuseum.nl, | |martin.renvoize@ptfs-europe | |.com Status|Signed Off |In Discussion --- Comment #3 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Security always has a price ;) I understand that it is easier to do it like this than adding much more code to achieve the same. But before we open the doors again for exceptions here and there, and compromise our security somewhere along the way, the release team should discuss and have concensus about that. Moving to ID Copying Martin as new QAM and Jonathan as CSRF expert. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 --- Comment #4 from Owen Leonard <oleonard@myacpl.org> --- (In reply to Phil Ringnalda from comment #0)
we don't believe that removing an item from an existing batch is worthy of CSRF protection
I believe so, and filed Bug 37206. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|phil@chetcolibrary.org |cnighswonger@foundations.ed | |u --- Comment #5 from Phil Ringnalda <phil@chetcolibrary.org> --- Okay, I think I've got it, but unassigning because I don't have enough time to do it right before I go on vacation. I should be old enough by now to know not to ever touch printing, because in every project it's canonically a tar-baby that's going to stick other bugs to you. What this Print label feature should be doing is not "add", because cud-add is actually two ops with one name: cud_add with a non-zero batch_id is add, cud_add with batch_id=0 or batch_id omitted is create-and-add, because new is very much not cud_new, it is show-blank-form. What this feature should be doing is calling new, with added behavior for new to stick a passed &item_id=n into the add textarea, where the user can then click Add to create-and-add, an awkward but necessary step. And ugh, someone really needs to fix bug 37223 because that's horrid behavior. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |37267 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37267 [Bug 37267] Allow specifying a target in form-submit.js -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 --- Comment #6 from Phil Ringnalda <phil@chetcolibrary.org> --- Meh, that's wrong. The user doesn't need to sit considering the repercussions of cud-add writing a line to creator_batches, they just need to show their csrf_token visa to be allowed in, and the link should just cud-add with form-submit.js. We just need bug 37267 to let the link keep opening a new window. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com --- Comment #7 from Phil Ringnalda <phil@chetcolibrary.org> --- *** Bug 37297 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 --- Comment #8 from Lucas Gass <lucas@bywatersolutions.com> --- Created attachment 168839 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168839&action=edit Bug 37192: Add ability to pass data-new_tab to form-submit.js and open in new tab -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 --- Comment #9 from Lucas Gass <lucas@bywatersolutions.com> --- Created attachment 168840 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168840&action=edit Bug 37192: Adjust template for additem.tt Test plan: 1. Search the catalog for something that will return results, like Perl 2. On any bib that has at least one item, click Edit items 3. In the Actions menu to the left of any item, choose Print label 4. That opened a popup with a 500 error rather than a label batch editor 5. Apply patch, restart_all 6. Repeat step 3, but this time you'll get a label batch editor with your item in it. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168151|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|In Discussion |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 ByWater Sandboxes <bws.sandboxes@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168839|0 |1 is obsolete| | --- Comment #10 from ByWater Sandboxes <bws.sandboxes@gmail.com> --- Created attachment 168851 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168851&action=edit Bug 37192: Add ability to pass data-new_tab to form-submit.js and open in new tab Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 ByWater Sandboxes <bws.sandboxes@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168840|0 |1 is obsolete| | --- Comment #11 from ByWater Sandboxes <bws.sandboxes@gmail.com> --- Created attachment 168852 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168852&action=edit Bug 37192: Adjust template for additem.tt Test plan: 1. Search the catalog for something that will return results, like Perl 2. On any bib that has at least one item, click Edit items 3. In the Actions menu to the left of any item, choose Print label 4. That opened a popup with a 500 error rather than a label batch editor 5. Apply patch, restart_all 6. Repeat step 3, but this time you'll get a label batch editor with your item in it. Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on|37267 | --- Comment #12 from Phil Ringnalda <phil@chetcolibrary.org> --- *** Bug 37267 has been marked as a duplicate of this bug. *** Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37267 [Bug 37267] Allow specifying a target in form-submit.js -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 CJ L. <cj.lynce@westlakelibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |cj.lynce@westlakelibrary.or | |g -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|cnighswonger@foundations.ed |lucas@bywatersolutions.com |u | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168851|0 |1 is obsolete| | --- Comment #13 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 169089 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169089&action=edit Bug 37192: Add ability to pass data-new_tab to form-submit.js and open in new tab Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168852|0 |1 is obsolete| | --- Comment #14 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 169090 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169090&action=edit Bug 37192: Adjust template for additem.tt Test plan: 1. Search the catalog for something that will return results, like Perl 2. On any bib that has at least one item, click Edit items 3. In the Actions menu to the left of any item, choose Print label 4. That opened a popup with a 500 error rather than a label batch editor 5. Apply patch, restart_all 6. Repeat step 3, but this time you'll get a label batch editor with your item in it. Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA --- Comment #15 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Pragmatic solution without re-writing the whole of Koha. Passing QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 --- Comment #16 from Lucas Gass <lucas@bywatersolutions.com> --- Maybe this has already been done somewhere else but if not, we should document how to use form-submit.js somewhere. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |martin.renvoize@ptfs-europe |y.org |.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |24.11.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 --- Comment #17 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.11! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 --- Comment #18 from CJ Lynce <cj.lynce@westlakelibrary.org> --- Could this be backported to 24.05? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com Text to go in the| |This fixes a 500 error that release notes| |occurs when attempting to | |print a label for an item | |in the staff interface | |(from the record details | |page > Edit > Edit items > | |Actions > Print label (for | |a specific item). The label | |batch editor now opens (as | |expected). -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC|martin.renvoize@ptfs-europe | |.com | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |rel_24_05_candidate -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Chip Halvorsen <Chip.Halvorsen@WestlakeLibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |Chip.Halvorsen@WestlakeLibr | |ary.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable Version(s)|24.11.00 |24.11.00,24.05.04 released in| | --- Comment #19 from Lucas Gass <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.04 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|rel_24_05_candidate | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting CC| |fridolin.somers@biblibre.co | |m --- Comment #20 from Fridolin Somers <fridolin.somers@biblibre.com> --- Not for 23.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Needs documenting |RESOLVED --- Comment #21 from Lucas Gass <lucas@bywatersolutions.com> --- fixes a bug, nothing to document -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37192 Bug 37192 depends on bug 36192, which changed state. Bug 36192 Summary: [OMNIBUS] CSRF Protection for Koha https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org