[Bug 36190] New: op param for stateful requests must start with 'cud-'
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 Bug ID: 36190 Summary: op param for stateful requests must start with 'cud-' Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: jonathan.druart+koha@gmail.com QA Contact: testopia@bugs.koha-community.org This is enforced in Koha::Middleware::CSRF but the tests is not catching incorrect occurrences. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |34478 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 --- Comment #1 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Created attachment 162530 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162530&action=edit Bug 36190: Adjust the test -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 --- Comment #2 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Created attachment 162531 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162531&action=edit Bug 36190: To not assume op is invalid if it is a TT variable -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |36192 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=36305 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #162530|0 |1 is obsolete| | Attachment #162531|0 |1 is obsolete| | --- Comment #3 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 163110 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163110&action=edit Bug 36190: To not assume op is invalid if it is a TT variable Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 --- Comment #4 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 163111 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163111&action=edit Bug 36190: (QA follow-up) Tidy -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 --- Comment #5 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 163112 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163112&action=edit Bug 36190: Fix problems found by test opac-shelves - forms were stateless - changed to GET sco-main - forms stateless - changed to GET ** untested because sco + auth is broken smart-rules.tt - JS form template - added placeholder 'cud-' op ill-requests - added cud- tp ops ** tested comments, but not checkout, simple changes boraccount - removed repeated op - updated script patroncards/edit-batch - add placeholder 'cud-' op patroncards/manage - add placheholder 'cud-' op elasticsearch/mappings - separate forms - this could use a style follow-up, but makes more sense separate I think reports/dictionary - stateless - changed to GET guided_reports_start - stateless - changed to GET suggestion/suggestion - add placeholder 'cud-' op inventory - filed bug 36305, needs more handling -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |nick@bywatersolutions.com |ity.org | CC| |nick@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com Status|Needs Signoff |Failed QA --- Comment #6 from David Nind <david@davidnind.com> --- I'm getting a sha1/fake ancestor error when trying to apply the patch: Applying: Bug 36190: To not assume op is invalid if it is a TT variable error: sha1 information is lacking or useless (xt/find-missing-op-in-forms.t). error: could not build fake ancestor Patch failed at 0001 Bug 36190: To not assume op is invalid if it is a TT variable ... Testing notes - how I planned to test: 1. Run the tests before the patch is applied: prove xt/find-missing-op-in-forms.t 2. Apply the first patch and run the tests: tests should fail 3. Apply the rest of the patches and run the tests: tests should pass! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #162530|1 |0 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff --- Comment #7 from Nick Clemens <nick@bywatersolutions.com> --- (In reply to David Nind from comment #6)
I'm getting a sha1/fake ancestor error when trying to apply the patch:
Fixed, I obsoleted a patch without reattaching
Testing notes - how I planned to test: 1. Run the tests before the patch is applied: prove xt/find-missing-op-in-forms.t 2. Apply the first patch and run the tests: tests should fail 3. Apply the rest of the patches and run the tests: tests should pass!
Correct, except the test will have 1 remaining failure, should be handled on bug 36305 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #162530|0 |1 is obsolete| | --- Comment #8 from David Nind <david@davidnind.com> --- Created attachment 163149 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163149&action=edit Bug 36190: Adjust the test Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #163110|0 |1 is obsolete| | --- Comment #9 from David Nind <david@davidnind.com> --- Created attachment 163150 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163150&action=edit Bug 36190: To not assume op is invalid if it is a TT variable Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #163111|0 |1 is obsolete| | --- Comment #10 from David Nind <david@davidnind.com> --- Created attachment 163151 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163151&action=edit Bug 36190: (QA follow-up) Tidy Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #163112|0 |1 is obsolete| | --- Comment #11 from David Nind <david@davidnind.com> --- Created attachment 163152 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163152&action=edit Bug 36190: Fix problems found by test opac-shelves - forms were stateless - changed to GET sco-main - forms stateless - changed to GET ** untested because sco + auth is broken smart-rules.tt - JS form template - added placeholder 'cud-' op ill-requests - added cud- tp ops ** tested comments, but not checkout, simple changes boraccount - removed repeated op - updated script patroncards/edit-batch - add placeholder 'cud-' op patroncards/manage - add placheholder 'cud-' op elasticsearch/mappings - separate forms - this could use a style follow-up, but makes more sense separate I think reports/dictionary - stateless - changed to GET guided_reports_start - stateless - changed to GET suggestion/suggestion - add placeholder 'cud-' op inventory - filed bug 36305, needs more handling Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 --- Comment #12 from David Nind <david@davidnind.com> --- Thanks Nick! Testing notes (using KTD): 1. Run the tests before the patch is applied - tests should pass: prove -v xt/find-missing-op-in-forms.t 2. Apply the first three patches (using interactive mode) and run the tests: tests should fail with 12 forms missing the required information 3. Apply the remaining patch and run the tests again: tests still fail,[1] but this time there is only 1 form missing the required information (addressed in bug 36305) [1] After all patches are applied, only 1 form is missing the required information prove -v xt/find-missing-op-in-forms.t xt/find-missing-op-in-forms.t .. 1..1 not ok 1 - The <form> in the following files are missing it's corresponding op parameter, or op does not start with 'cud-' (see bug 34478) # Failed test 'The <form> in the following files are missing it's corresponding op parameter, or op does not start with 'cud-' (see bug 34478)' # at xt/find-missing-op-in-forms.t line 43. # got: '1' # expected: '0' # $VAR1 = 'koha-tmpl/intranet-tmpl/prog/en/modules/tools/inventory.tt:71,248'; # Looks like you failed 1 test of 1. Dubious, test returned 1 (wstat 256, 0x100) Failed 1/1 subtests Test Summary Report ------------------- xt/find-missing-op-in-forms.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 Files=1, Tests=1, 0 wallclock secs ( 0.01 usr 0.00 sys + 0.15 cusr 0.01 csys = 0.17 CPU) Result: FAIL -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #163149|0 |1 is obsolete| | --- Comment #13 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 163162 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163162&action=edit Bug 36190: Adjust the test Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #163150|0 |1 is obsolete| | --- Comment #14 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 163163 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163163&action=edit Bug 36190: To not assume op is invalid if it is a TT variable Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #163151|0 |1 is obsolete| | --- Comment #15 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 163164 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163164&action=edit Bug 36190: (QA follow-up) Tidy Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #163152|0 |1 is obsolete| | --- Comment #16 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 163165 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163165&action=edit Bug 36190: Fix problems found by test opac-shelves - forms were stateless - changed to GET sco-main - forms stateless - changed to GET ** untested because sco + auth is broken smart-rules.tt - JS form template - added placeholder 'cud-' op ill-requests - added cud- tp ops ** tested comments, but not checkout, simple changes boraccount - removed repeated op - updated script patroncards/edit-batch - add placeholder 'cud-' op patroncards/manage - add placheholder 'cud-' op elasticsearch/mappings - separate forms - this could use a style follow-up, but makes more sense separate I think reports/dictionary - stateless - changed to GET guided_reports_start - stateless - changed to GET suggestion/suggestion - add placeholder 'cud-' op inventory - filed bug 36305, needs more handling Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |m.de.rooy@rijksmuseum.nl |y.org | CC| |m.de.rooy@rijksmuseum.nl -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to master Version(s)| |24.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 --- Comment #17 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Status|Pushed to master |RESOLVED Resolution|--- |FIXED --- Comment #18 from Fridolin Somers <fridolin.somers@biblibre.com> --- Depends on Bug 34478 not in 23.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 Bug 36190 depends on bug 34478, which changed state. Bug 34478 Summary: Full CSRF protection https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org