[Bug 37769] New: Fix forms that POST without an op in currency administration
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37769 Bug ID: 37769 Summary: Fix forms that POST without an op in currency administration Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P3 Component: System Administration Assignee: phil@chetcolibrary.org Reporter: phil@chetcolibrary.org QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com Depends on: 36192 Blocks: 37728 We intend not to have forms with method="post" without an op variable (so we can check that the op starts with "cud-" as part of the CSRF protection), but because of bug 37728 some were missed. In Currency and exchange rate administration, that's the "OK" button that takes you back to the list when you try to delete a currency in use by a vendor, which doesn't need to POST, and the OK button in the confirmation page after you delete a currency, which currently doesn't actually show at all, but when it does doesn't need to POST since it just takes you back to the list of currencies. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37728 [Bug 37728] More "op" are missing in POSTed forms -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37769 --- Comment #1 from Phil Ringnalda <phil@chetcolibrary.org> --- Too many near-identical bugs, the second instance is not in a confirmation page after deleting, currencies don't have one, it is in the "No, do not delete" cancel button when you could confirm deletion but instead decide not to delete. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37769 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37769 --- Comment #2 from Phil Ringnalda <phil@chetcolibrary.org> --- Created attachment 170890 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=170890&action=edit Bug 37769: Fix forms that POST without an op in currency administration We intend not to have forms with method="post" without an op variable (so we can check that the op starts with "cud-" as part of the CSRF protection), but because of bug 37728 some were missed. This patch changes the form around the OK button when you are told you can't delete a currency which is in use, and the No, do not delete button when you could delete a currency and decide not to, from a POST to a GET because all they need to do is show the list of currencies again. The only visible change from the patch is that the URL will end with a "?" from having done a GET without any params. Someone who wants to decide which of our link-as-cancel-button styles to use is welcome to switch them to links, in a bug not blocking an RM_priority bug. Test plan: 1. No changes to see, so apply the patch first 2. Administration - Currencies and exchange rates 3. You need one currency in use and one not in use. Luckily, ktd gave you USD for in use, and GBP for not in use. For USD, click the Deleete button 4. On the page telling you that you can't delete it because it's in use, click the OK button and verify that you are back at the list of currencies 5. Click the Delete button for GBP, then the No, do not delete button 6. Verify that you are back at the list of currencies Sponsored-by: Chetco Community Public Library -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37769 Sukhmandeep <sukhmandeep.benipal@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #170890|0 |1 is obsolete| | --- Comment #3 from Sukhmandeep <sukhmandeep.benipal@inLibro.com> --- Created attachment 171228 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=171228&action=edit Bug 37769: Fix forms that POST without an op in currency administration We intend not to have forms with method="post" without an op variable (so we can check that the op starts with "cud-" as part of the CSRF protection), but because of bug 37728 some were missed. This patch changes the form around the OK button when you are told you can't delete a currency which is in use, and the No, do not delete button when you could delete a currency and decide not to, from a POST to a GET because all they need to do is show the list of currencies again. The only visible change from the patch is that the URL will end with a "?" from having done a GET without any params. Someone who wants to decide which of our link-as-cancel-button styles to use is welcome to switch them to links, in a bug not blocking an RM_priority bug. Test plan: 1. No changes to see, so apply the patch first 2. Administration - Currencies and exchange rates 3. You need one currency in use and one not in use. Luckily, ktd gave you USD for in use, and GBP for not in use. For USD, click the Deleete button 4. On the page telling you that you can't delete it because it's in use, click the OK button and verify that you are back at the list of currencies 5. Click the Delete button for GBP, then the No, do not delete button 6. Verify that you are back at the list of currencies Sponsored-by: Chetco Community Public Library Signed-off-by: Sukhmandeep Benipal <sukhmandeep.benipal@inLibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37769 Sukhmandeep <sukhmandeep.benipal@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sukhmandeep.benipal@inLibro | |.com Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37769 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37769 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #171228|0 |1 is obsolete| | --- Comment #4 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 171539 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=171539&action=edit Bug 37769: Fix forms that POST without an op in currency administration We intend not to have forms with method="post" without an op variable (so we can check that the op starts with "cud-" as part of the CSRF protection), but because of bug 37728 some were missed. This patch changes the form around the OK button when you are told you can't delete a currency which is in use, and the No, do not delete button when you could delete a currency and decide not to, from a POST to a GET because all they need to do is show the list of currencies again. The only visible change from the patch is that the URL will end with a "?" from having done a GET without any params. Someone who wants to decide which of our link-as-cancel-button styles to use is welcome to switch them to links, in a bug not blocking an RM_priority bug. Test plan: 1. No changes to see, so apply the patch first 2. Administration - Currencies and exchange rates 3. You need one currency in use and one not in use. Luckily, ktd gave you USD for in use, and GBP for not in use. For USD, click the Deleete button 4. On the page telling you that you can't delete it because it's in use, click the OK button and verify that you are back at the list of currencies 5. Click the Delete button for GBP, then the No, do not delete button 6. Verify that you are back at the list of currencies Sponsored-by: Chetco Community Public Library Signed-off-by: Sukhmandeep Benipal <sukhmandeep.benipal@inLibro.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37769 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |jonathan.druart@gmail.com |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37769 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |24.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37769 --- Comment #5 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.11! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37769 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com Resolution|--- |FIXED Status|Pushed to main |RESOLVED --- Comment #6 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Doesn't apply cleanly to 24.05.x, please rebase if needed. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37769 Bug 37769 depends on bug 36192, which changed state. Bug 36192 Summary: [OMNIBUS] CSRF Protection for Koha https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon@bugs.koha-community.org