[Bug 37961] New: Inventory followup fails by POSTing without an op or csrf_token
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37961 Bug ID: 37961 Summary: Inventory followup fails by POSTing without an op or csrf_token Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Keywords: regression, rel_24_05_candidate Severity: major Priority: P1 - high Component: Tools Assignee: phil@chetcolibrary.org Reporter: phil@chetcolibrary.org QA Contact: testopia@bugs.koha-community.org Depends on: 36192 After you upload a file or textarea of barcodes to inventory, the next step is a list of the things that were missing, with checkboxes to check when you find them, and buttons to Mark seen, which send a POST to /cgi-bin/koha/tools/ajax-inventory.pl without an op param (since it doesn't have an $op) and without a csrf_token, so the POST fails with a 403. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37961 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37961 --- Comment #1 from Phil Ringnalda <phil@chetcolibrary.org> --- Created attachment 171700 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=171700&action=edit Bug 37961: Inventory problem resolution fails by POSTing without an op or csrf_token After you upload a file or textarea of barcodes to inventory, the next step is a list of the things that were missing, with checkboxes to check when you find them, and buttons to Mark seen, which send a POST to /cgi-bin/koha/tools/ajax-inventory.pl without an op param (since it doesn't have an $op) and without a csrf_token, so the POST fails with a 403. Test plan: 1. Without the patch, Cataloging - Inventory - in Item location filters set Library to Centerville, Shelving location to Audio visual, Collection code to Reference, and in Optional filters for inventory list or comparing barcodes set Last inventory date to today. 2. Click Submit, and you'll have a table of 23 items. Check the checkbox for the first item, click Mark seen and continue 3. What was supposed to happen was that you would be taken to the next page, but instead you are still in the same page, and if you had the browser console open, you would have seen that you sent a POST to ajax-inventory.pl, and got a 403 error in response 4. Apply patch, restart_all 5. Repeat step 1 and 2, this time getting to the second page. Check the checkboxes for the last two items, and click Mark seen and quit 6. Repeat step 1 and click Submit. You should now have only 20 items, since the three you checked now have a Last inventory date of today. Yeah, when you did Mark seen and continue they ought to have been removed from the list, I agree. I had to go back to 23.11.x and make sure that was really how it was supposed to function, but that is the existing behavior. Even though they get marked as seen, nothing changes about your list until you quit and go back to it. Maybe because then something that wasn't on the current page would have moved there. Another bug. Sponsored-by: Chetco Community Public Library -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37961 Sonia Bouis <sonia.bouis@univ-lyon3.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sonia.bouis@univ-lyon3.fr Status|Needs Signoff |Failed QA --- Comment #2 from Sonia Bouis <sonia.bouis@univ-lyon3.fr> --- Hi, I 've tested without the patch and I can see that we are stucked in the list of items even when we tick one of them and click on "mark seen and continue", it's the same page and nothing happen. But I have exactly the same behaviour after installing the patch :( Sonia -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37961 --- Comment #3 from Phil Ringnalda <phil@chetcolibrary.org> --- That's odd, I just tried it myself and it still works for me. Do you have more than 20 items, so there's a second page to go to when you check the first item and Mark seen and continue? That button is still present and enabled even when there isn't another page to continue to, so on the last page it will look like nothing happened. If you open the browser console, does it show any error when you Mark seen and continue? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37961 Sonia Bouis <sonia.bouis@univ-lyon3.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #171700|0 |1 is obsolete| | --- Comment #4 from Sonia Bouis <sonia.bouis@univ-lyon3.fr> --- Created attachment 172150 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=172150&action=edit Bug 37961: Inventory problem resolution fails by POSTing without an op or csrf_token After you upload a file or textarea of barcodes to inventory, the next step is a list of the things that were missing, with checkboxes to check when you find them, and buttons to Mark seen, which send a POST to /cgi-bin/koha/tools/ajax-inventory.pl without an op param (since it doesn't have an $op) and without a csrf_token, so the POST fails with a 403. Test plan: 1. Without the patch, Cataloging - Inventory - in Item location filters set Library to Centerville, Shelving location to Audio visual, Collection code to Reference, and in Optional filters for inventory list or comparing barcodes set Last inventory date to today. 2. Click Submit, and you'll have a table of 23 items. Check the checkbox for the first item, click Mark seen and continue 3. What was supposed to happen was that you would be taken to the next page, but instead you are still in the same page, and if you had the browser console open, you would have seen that you sent a POST to ajax-inventory.pl, and got a 403 error in response 4. Apply patch, restart_all 5. Repeat step 1 and 2, this time getting to the second page. Check the checkboxes for the last two items, and click Mark seen and quit 6. Repeat step 1 and click Submit. You should now have only 20 items, since the three you checked now have a Last inventory date of today. Yeah, when you did Mark seen and continue they ought to have been removed from the list, I agree. I had to go back to 23.11.x and make sure that was really how it was supposed to function, but that is the existing behavior. Even though they get marked as seen, nothing changes about your list until you quit and go back to it. Maybe because then something that wasn't on the current page would have moved there. Another bug. Sponsored-by: Chetco Community Public Library Signed-off-by: Sonia Bouis <sonia.bouis@univ-lyon3.fr> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37961 Sonia Bouis <sonia.bouis@univ-lyon3.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Signed Off --- Comment #5 from Sonia Bouis <sonia.bouis@univ-lyon3.fr> --- Oh sorry, my fault. I've few data in my ktd database and I didn't see that there are less than 20. So I tested with more than 20 items in the results and it actually changes to the second page when we click on "click Mark seen and continue". I know it have to be in another bug, but I would be better if the button "click Mark seen and continue" doesn't appear if there are less than 20 items. Sonia -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37961 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kyle@bywatersolutions.com QA Contact|testopia@bugs.koha-communit |kyle@bywatersolutions.com |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37961 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37961 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #172150|0 |1 is obsolete| | --- Comment #6 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 172183 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=172183&action=edit Bug 37961: Inventory problem resolution fails by POSTing without an op or csrf_token After you upload a file or textarea of barcodes to inventory, the next step is a list of the things that were missing, with checkboxes to check when you find them, and buttons to Mark seen, which send a POST to /cgi-bin/koha/tools/ajax-inventory.pl without an op param (since it doesn't have an $op) and without a csrf_token, so the POST fails with a 403. Test plan: 1. Without the patch, Cataloging - Inventory - in Item location filters set Library to Centerville, Shelving location to Audio visual, Collection code to Reference, and in Optional filters for inventory list or comparing barcodes set Last inventory date to today. 2. Click Submit, and you'll have a table of 23 items. Check the checkbox for the first item, click Mark seen and continue 3. What was supposed to happen was that you would be taken to the next page, but instead you are still in the same page, and if you had the browser console open, you would have seen that you sent a POST to ajax-inventory.pl, and got a 403 error in response 4. Apply patch, restart_all 5. Repeat step 1 and 2, this time getting to the second page. Check the checkboxes for the last two items, and click Mark seen and quit 6. Repeat step 1 and click Submit. You should now have only 20 items, since the three you checked now have a Last inventory date of today. Yeah, when you did Mark seen and continue they ought to have been removed from the list, I agree. I had to go back to 23.11.x and make sure that was really how it was supposed to function, but that is the existing behavior. Even though they get marked as seen, nothing changes about your list until you quit and go back to it. Maybe because then something that wasn't on the current page would have moved there. Another bug. Sponsored-by: Chetco Community Public Library Signed-off-by: Sonia Bouis <sonia.bouis@univ-lyon3.fr> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37961 Martin Renvoize (ashimema) <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |24.11.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37961 --- Comment #7 from Martin Renvoize (ashimema) <martin.renvoize@ptfs-europe.com> --- Thanks for all the hard work! Pushed to main for the next 24.11.00 release as RM Assistant -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37961 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable CC| |lucas@bywatersolutions.com Keywords|rel_24_05_candidate | Version(s)|24.11.00 |24.11.00,24.05.05 released in| | --- Comment #8 from Lucas Gass <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37961 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting CC| |fridolin.somers@biblibre.co | |m --- Comment #9 from Fridolin Somers <fridolin.somers@biblibre.com> --- Not for 23.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37961 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37961 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sbrown@bywatersolutions.com --- Comment #10 from Phil Ringnalda <phil@chetcolibrary.org> --- *** Bug 38250 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37961 Bug 37961 depends on bug 36192, which changed state. Bug 36192 Summary: [OMNIBUS] CSRF Protection for Koha https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon@bugs.koha-community.org