[Bug 37853] New: Returning to your account at the end of changing your password in the OPAC doesn't need to POST a form
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37853 Bug ID: 37853 Summary: Returning to your account at the end of changing your password in the OPAC doesn't need to POST a form Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P3 Component: OPAC Assignee: phil@chetcolibrary.org Reporter: phil@chetcolibrary.org QA Contact: testopia@bugs.koha-community.org Depends on: 36192 Blocks: 37728 The end of the UI flow of changing your password in the OPAC is a page which tells you your password was changed (good, you need to know it's time to log out and back in to change your saved password, or that it's time to scribble out the old one on a Post-it and write down the new one), and then offers to take you back to your account with a button in a form which does a POST to opac-user.pl without an op and with your borrowernumber, which is double-bad. We intend not to allow POST without an op, and once the test is fixed in bug 37728 this will fail, and there's no need for the borrowernumber since it will be completely ignored by the script, which will instead get it from your cookie or make you log in. Instead of a form+button+POST, it should just be a link. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37728 [Bug 37728] More "op" are missing in POSTed forms -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37853 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37853 --- Comment #1 from Phil Ringnalda <phil@chetcolibrary.org> --- Created attachment 171107 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=171107&action=edit Bug 37853: Returning to your account at the end of changing your password in the OPAC doesn't need to POST a form Rather than having a form that does a POST (without an op, which isn't proper), the final step in changing your password in the OPAC should just be a link. Test plan: 1. Without the patch applied, log in to the OPAC as a user that you don't mind changing the password for 2. Welcome, {username} - Your account - Change password 3. Type the old password, and a new password twice, click Change password 4. Below the success message is a green button with white text, Return to my account - click it 5. Apply patch 6. Change password, type the (new) old password, and a (newer) new password twice, click Change password 7. Below the success message is what looks like a green button with white text, Return to my account 8. Hover the button, check your browser status bar for a URL showing you that it's now a link. Click it to be sure it works. Sponsored-by: Chetco Community Public Library -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37853 Olivier V <ovezina@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #171107|0 |1 is obsolete| | --- Comment #2 from Olivier V <ovezina@inlibro.com> --- Created attachment 171193 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=171193&action=edit Bug 37853: Returning to your account at the end of changing your password in the OPAC doesn't need to POST a form Rather than having a form that does a POST (without an op, which isn't proper), the final step in changing your password in the OPAC should just be a link. Test plan: 1. Without the patch applied, log in to the OPAC as a user that you don't mind changing the password for 2. Welcome, {username} - Your account - Change password 3. Type the old password, and a new password twice, click Change password 4. Below the success message is a green button with white text, Return to my account - click it 5. Apply patch 6. Change password, type the (new) old password, and a (newer) new password twice, click Change password 7. Below the success message is what looks like a green button with white text, Return to my account 8. Hover the button, check your browser status bar for a URL showing you that it's now a link. Click it to be sure it works. Sponsored-by: Chetco Community Public Library Signed-off-by: Olivier V <olivier.vezina@inLibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37853 Olivier V <ovezina@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off CC| |ovezina@inlibro.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37853 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37853 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #171193|0 |1 is obsolete| | --- Comment #3 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 171311 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=171311&action=edit Bug 37853: Do not POST a form at the end of changing the password (OPAC) Rather than having a form that does a POST (without an op, which isn't proper), the final step in changing your password in the OPAC should just be a link. Test plan: 1. Without the patch applied, log in to the OPAC as a user that you don't mind changing the password for 2. Welcome, {username} - Your account - Change password 3. Type the old password, and a new password twice, click Change password 4. Below the success message is a green button with white text, Return to my account - click it 5. Apply patch 6. Change password, type the (new) old password, and a (newer) new password twice, click Change password 7. Below the success message is what looks like a green button with white text, Return to my account 8. Hover the button, check your browser status bar for a URL showing you that it's now a link. Click it to be sure it works. Sponsored-by: Chetco Community Public Library Signed-off-by: Olivier V <olivier.vezina@inLibro.com> Amended-by: Jonathan Druart Edited commit message Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37853 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |jonathan.druart@gmail.com |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37853 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |24.11.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37853 --- Comment #4 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.11! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37853 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com Version(s)|24.11.00 |24.11.00,24.05.06 released in| | Status|Pushed to main |Pushed to stable --- Comment #5 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.06 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37853 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Status|Pushed to stable |Needs documenting --- Comment #6 from Fridolin Somers <fridolin.somers@biblibre.com> --- Not for 23.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37853 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Needs documenting |RESOLVED --- Comment #7 from Phil Ringnalda <phil@chetcolibrary.org> --- Nothing to document, the button looks identical and the only change is that it's a GET rather than a POST. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37853 Bug 37853 depends on bug 36192, which changed state. Bug 36192 Summary: [OMNIBUS] CSRF Protection for Koha https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org