[Bug 36195] New: CSRF - testing reports
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Bug ID: 36195 Summary: CSRF - testing reports Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: nick@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org This bug is for tracking follow-ups missed in the initial review. Please see the "testing reports" section on the framapad here: https://annuel.framapad.org/p/koha_34478_remaining Additional entries can be added there, and should be crossed out when completed Patches should be attached here This bug can be closed when that section of the pad is empty -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |36192 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 --- Comment #1 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 162668 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162668&action=edit Bug 36195: serials/routing-preview.pl - Fix save and preview No idea why we are passing issue_escaped instead of the id, but this patch fixes the regression. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |caroline.cyr-la-rose@inlibr | |o.com --- Comment #2 from Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> --- Hi, I'm not sure if this is where I should report this. I added it to the framapad, too... I can't search for items using the item search. It returns a 403: Forbidden message. To recreate: 1. Go to Item search 2. Click Search --> 403: Forbidden plack-intranet-error.log says [2024/03/05 22:06:45] [WARN] Programming error - op 'like' must start with 'cud-' for POST at /kohadevbox/koha/Koha/Middleware/CSRF.pm line 78. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 --- Comment #3 from David Cook <dcook@prosentient.com.au> --- (In reply to Caroline Cyr La Rose from comment #2)
I can't search for items using the item search. It returns a 403: Forbidden message.
I've looked into this one a bit (as I noticed on framapad), and I think itemsearch.pl is going to require some refactoring to fix its usage of "op". Basically, the "op" in the GET is fine, but it gets used for the POST to the API too. Could maybe convert that second POST to a GET, although it would be a long URL... -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 --- Comment #4 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 162960 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162960&action=edit Bug 36195: Replace POST batch_records_ajax.pl with GET We retrieve a list of records for DT, it does not need to be a POST request. Test plan: 1. Stage a batch 2. When it's done, click on "view batch" => Without this patch the page loads but pops an alert that says "403: Forbidden" and table stays empty -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 --- Comment #6 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 163049 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163049&action=edit Bug 36195: Replace POST in itemsearch.tt with GET -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #163049|0 |1 is obsolete| | --- Comment #7 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 163050 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163050&action=edit Bug 36195: Replace POST in itemsearch.tt with GET We retrieve a list of records for DT, it does not need to be a POST request. Test plan: 1. Try an item search 2. The page loads but pops an alert that says "403: Forbidden" and table stays empty 3. Apply patch 4. Try an item search again and the table loads results -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |blawlor@clamsnet.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Dave <ddaghita@mckinneytexas.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ddaghita@mckinneytexas.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #162668|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #162960|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #163050|0 |1 is obsolete| | --- Comment #8 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Comment on attachment 163050 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163050 Bug 36195: Replace POST in itemsearch.tt with GET
From 28f445587ee8e7f70852367f2c9e37ae2c4ebcea Mon Sep 17 00:00:00 2001 From: Brendan Lawlor <blawlor@clamsnet.org> Date: Mon, 11 Mar 2024 17:32:08 +0000 Subject: [PATCH] Bug 36195: Replace POST in itemsearch.tt with GET
We retrieve a list of records for DT, it does not need to be a POST request.
Test plan:
1. Try an item search 2. The page loads but pops an alert that says "403: Forbidden" and table stays empty 3. Apply patch 4. Try an item search again and the table loads results --- koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt | 1 - 1 file changed, 1 deletion(-)
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt index b3a89e508c..db703115b3 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt @@ -478,7 +478,6 @@ "processing": true, "ajax": { url: '/cgi-bin/koha/catalogue/itemsearch.pl', - type: 'POST', data: function ( d ) { for (i in params) { d[params[i].name] = params[i].value; -- 2.30.2
-- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 --- Comment #9 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Last 3 patches pushed to master and obsoleted here. Thanks! -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 --- Comment #10 from Victor Grousset/tuxayo <victor@tuxayo.net> --- I reported the issue corresponding to Bug 36280 in the pad just a day before promulgation of directive «Please file individual bugs to deal with remaining issues per RM request» Just writing here to be sure that report didn't slip under the radar due to being right before the change in strategy for CSRF related regressions. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 --- Comment #11 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to Victor Grousset/tuxayo from comment #10)
I reported the issue corresponding to Bug 36280 in the pad just a day before promulgation of directive «Please file individual bugs to deal with remaining issues per RM request»
Just writing here to be sure that report didn't slip under the radar due to being right before the change in strategy for CSRF related regressions.
I pushed all patches on this and the other CSRF bug today. So this is just for future bugs. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m --- Comment #12 from Fridolin Somers <fridolin.somers@biblibre.com> --- Depends on Bug 34478 no ? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |34478 --- Comment #13 from David Cook <dcook@prosentient.com.au> --- (In reply to Fridolin Somers from comment #12)
Depends on Bug 34478 no ?
Yep. I've just added as dependency. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 [Bug 34478] Full CSRF protection -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |36349 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36349 [Bug 36349] Login for SCO/SCI broken by CSRF -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 --- Comment #14 from Victor Grousset/tuxayo <victor@tuxayo.net> --- I see on the pad «Make sure to file as blocker for 36192» So I might have linked bug 36349 in the wrong way. Does it mean that other bugs need be listed here in "depends on"? Like an omnibus. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 --- Comment #15 from Fridolin Somers <fridolin.somers@biblibre.com> --- Indeed, I'm looking at graph from Bug 34478 and this dependancy looks wrong -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |collector CC| |martin.renvoize@ptfs-europe | |.com -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |37203 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37203 [Bug 37203] Add a booking is ready to collect notice to let patrons know that their booking is ready to be collected -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |37204 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37204 [Bug 37204] Add a booking has changed notice to update a patron should a booking be updated -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|37203 | Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37203 [Bug 37203] Add a booking is ready to collect notice to let patrons know that their booking is ready to be collected -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|37204 | Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37204 [Bug 37204] Add a booking has changed notice to update a patron should a booking be updated -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Manos PETRIDIS <egpetridis@yahoo.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |egpetridis@yahoo.com --- Comment #16 from Manos PETRIDIS <egpetridis@yahoo.com> --- Could bug https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37978 be related? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 --- Comment #17 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Almost sure not: bug 37978 comment 10 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 --- Comment #18 from Martin Renvoize (ashimema) <martin.renvoize@ptfs-europe.com> --- I'm not really seeing much use of this bug.. should we close it at this point as I'm not sure it's really serving any meaningful purpose. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 --- Comment #19 from David Cook <dcook@prosentient.com.au> --- (In reply to Martin Renvoize (ashimema) from comment #18)
I'm not really seeing much use of this bug.. should we close it at this point as I'm not sure it's really serving any meaningful purpose.
Yeah I've been thinking that lately too -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Martin Renvoize (ashimema) <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |FIXED -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Bug 36195 depends on bug 34478, which changed state. Bug 34478 Summary: Full CSRF protection https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org