[Bug 17109] New: sendbasket (working title)
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 Bug ID: 17109 Summary: sendbasket (working title) Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard@myacpl.org Reporter: m.de.rooy@rijksmuseum.nl QA Contact: testopia@bugs.koha-community.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |17096 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|oleonard@myacpl.org |m.de.rooy@rijksmuseum.nl Patch complexity|--- |Small patch Summary|sendbasket (working title) |sendbasket: Remove second | |authentication, add CSRF | |token -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 --- Comment #1 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 54309 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54309&action=edit Bug 17109: Remove second authentication from (opac-)sendbasket Patch deals with opac and intranet variant. If we authenticated the first time, it is not necessary to do it a second time rightaway. Replaces a call to get_template_and_user (including checkauth) by gettemplate. Also removes duplicate use C4::Biblio statements. Test plan: [1] Put a few books in the cart. [2] Send the cart from OPAC. [3] Send the cart from intranet. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 --- Comment #2 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 54310 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54310&action=edit Bug 17109: Add CSRF token to [opac-]sendbasket If you have no (valid) token, you will not be able to send the message. Test plan: [1] Verify if you can still send the cart from opac and intranet. [2] While still being logged in, try to send the cart from opac by using the following URL: /cgi-bin/koha/opac-sendbasket.pl?email_add=you@somedomain.com&comment=csrf_test&bib_list=doesnotmatter&csrf_token=justsomeguess12345 This should now result in a csrf error. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |16929 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16929 [Bug 16929] Prevent opac-memberentry waiting for random chars -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=14328 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |17110 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17110 [Bug 17110] Lower CSRF expiry in Koha::Token -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 --- Comment #3 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 54325 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54325&action=edit Bug 17109: Use Koha.Preference in sendbasket template No need to send OPACBaseURL to the template, if you load the Koha TT plugin inside the template. Test plan: Send a few items in your cart from OPAC and intranet. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #54309|0 |1 is obsolete| | --- Comment #4 from Marc Véron <veron@veron.ch> --- Created attachment 54470 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54470&action=edit Bug 17109: Remove second authentication from (opac-)sendbasket Patch deals with opac and intranet variant. If we authenticated the first time, it is not necessary to do it a second time rightaway. Replaces a call to get_template_and_user (including checkauth) by gettemplate. Also removes duplicate use C4::Biblio statements. Test plan: [1] Put a few books in the cart. [2] Send the cart from OPAC. [3] Send the cart from intranet. Tested 3 patches together. Works as expected. Signed-off-by: Marc Véron <veron@veron.ch> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #54310|0 |1 is obsolete| | --- Comment #5 from Marc Véron <veron@veron.ch> --- Created attachment 54471 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54471&action=edit Bug 17109: Add CSRF token to [opac-]sendbasket If you have no (valid) token, you will not be able to send the message. Test plan: [1] Verify if you can still send the cart from opac and intranet. [2] While still being logged in, try to send the cart from opac by using the following URL: /cgi-bin/koha/opac-sendbasket.pl?email_add=you@somedomain.com&comment=csrf_test&bib_list=doesnotmatter&csrf_token=justsomeguess12345 This should now result in a csrf error. Signed-off-by: Marc Véron <veron@veron.ch> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #54325|0 |1 is obsolete| | --- Comment #6 from Marc Véron <veron@veron.ch> --- Created attachment 54472 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54472&action=edit Bug 17109: Use Koha.Preference in sendbasket template No need to send OPACBaseURL to the template, if you load the Koha TT plugin inside the template. Test plan: Send a few items in your cart from OPAC and intranet. Signed-off-by: Marc Véron <veron@veron.ch> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |veron@veron.ch Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 --- Comment #7 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Comment on attachment 54471 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54471 Bug 17109: Add CSRF token to [opac-]sendbasket Review of attachment 54471: --> (https://bugs.koha-community.org/bugzilla3/page.cgi?id=splinter.html&bug=17109&attachment=54471) ----------------------------------------------------------------- ::: koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt @@ +20,5 @@
[% END %]
+ [% IF csrf_error %] + <p>No valid CSRF token!</p> + <p><a class="focus close" href="#">Close window</a></p>
If you do that here, I will have to do it in all other places (and really don't want to! :) ) Are you sure we really want to stylish it? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 --- Comment #8 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 54503 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54503&action=edit Bug 17109: [QA Follow-up] Die when wrong token Removes template var csrf_error and associated handling. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Restested with opac and intranet: Still sends or dies elegantly.. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 --- Comment #9 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Jonathan Druart from comment #7)
If you do that here, I will have to do it in all other places (and really don't want to! :) ) Are you sure we really want to stylish it?
No problem -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #54470|0 |1 is obsolete| | Attachment #54471|0 |1 is obsolete| | Attachment #54472|0 |1 is obsolete| | Attachment #54503|0 |1 is obsolete| | --- Comment #10 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 54705 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54705&action=edit Bug 17109: Remove second authentication from (opac-)sendbasket Patch deals with opac and intranet variant. If we authenticated the first time, it is not necessary to do it a second time rightaway. Replaces a call to get_template_and_user (including checkauth) by gettemplate. Also removes duplicate use C4::Biblio statements. Test plan: [1] Put a few books in the cart. [2] Send the cart from OPAC. [3] Send the cart from intranet. Tested 3 patches together. Works as expected. Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 --- Comment #11 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 54706 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54706&action=edit Bug 17109: Add CSRF token to [opac-]sendbasket If you have no (valid) token, you will not be able to send the message. Test plan: [1] Verify if you can still send the cart from opac and intranet. [2] While still being logged in, try to send the cart from opac by using the following URL: /cgi-bin/koha/opac-sendbasket.pl?email_add=you@somedomain.com&comment=csrf_test&bib_list=doesnotmatter&csrf_token=justsomeguess12345 This should now result in a csrf error. Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 --- Comment #12 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 54707 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54707&action=edit Bug 17109: Use Koha.Preference in sendbasket template No need to send OPACBaseURL to the template, if you load the Koha TT plugin inside the template. Test plan: Send a few items in your cart from OPAC and intranet. Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 --- Comment #13 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 54708 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54708&action=edit Bug 17109: [QA Follow-up] Die when wrong token Removes template var csrf_error and associated handling. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Restested with opac and intranet: Still sends or dies elegantly.. Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kyle@bywatersolutions.com Status|Passed QA |Pushed to Master --- Comment #14 from Kyle M Hall <kyle@bywatersolutions.com> --- Pushed to master for 16.11, thanks Marcel! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 Mason James <mtj@kohaaloha.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mtj@kohaaloha.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17109 --- Comment #15 from Mason James <mtj@kohaaloha.com> --- Pushed to 16.05.x, for 16.05.12 release -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org