[Bug 37342] New: CSRF error - Cannot add new authorities from basic editor with 'Link authorities automatically'
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 Bug ID: 37342 Summary: CSRF error - Cannot add new authorities from basic editor with 'Link authorities automatically' Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Cataloging Assignee: koha-bugs@lists.koha-community.org Reporter: nick@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl To recreate: 1 - Go to cataloging -> new record 2 - If not in basic editor, switch 3 - Go to tab 100 4 - Enter a name that has no authority in your system: McNotExist, Falsy 5 - Click 'Link authorities automatically' 6 - subfield 9 should turn red, and have an X and a + button 7 - Click the green + 8 - Boom -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 --- Comment #1 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- Created attachment 168901 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168901&action=edit Bug 37342: Use get for launching authority popup This patch simply switches to a GET as the operation is not cud To test: 1 - Go to cataloging -> new record 2 - If not in basic editor, switch 3 - Go to tab 100 4 - Enter a name that has no authority in your system: McNotExist, Falsy 5 - Click 'Link authorities automatically' 6 - subfield 9 should turn red, and have an X and a + button 7 - Click the green + 8 - Boom 9 - Apply patch 10 - Reload page and repeat (clear cache so js reloads) 11 - Success! Authority window launches -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |nick@bywatersolutions.com |ity.org | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 Jake Deery <jake.deery@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168901|0 |1 is obsolete| | --- Comment #2 from Jake Deery <jake.deery@ptfs-europe.com> --- Created attachment 168903 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168903&action=edit Bug 37342: Use get for launching authority popup This patch simply switches to a GET as the operation is not cud To test: 1 - Go to cataloging -> new record 2 - If not in basic editor, switch 3 - Go to tab 100 4 - Enter a name that has no authority in your system: McNotExist, Falsy 5 - Click 'Link authorities automatically' 6 - subfield 9 should turn red, and have an X and a + button 7 - Click the green + 8 - Boom 9 - Apply patch 10 - Reload page and repeat (clear cache so js reloads) 11 - Success! Authority window launches Signed-off-by: Jake Deery <jake.deery@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 Jake Deery <jake.deery@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off CC| |jake.deery@ptfs-europe.com --- Comment #3 from Jake Deery <jake.deery@ptfs-europe.com> --- Hi Nick, Able to reproduce, and the patch has the expected outcome. Signed off with thanks! Jake. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 --- Comment #4 from Jake Deery <jake.deery@ptfs-europe.com> --- Hi Nick, Looks good to me, happy to sign this one off and over to QA..! Signed off with thanks. Jake. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 --- Comment #5 from Jake Deery <jake.deery@ptfs-europe.com> --- Ugh, how come I refreshed that and couldn't see my own comment..! Sorry for the noise folks. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168903|0 |1 is obsolete| | --- Comment #6 from Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> --- Created attachment 169055 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169055&action=edit Bug 37342: Use get for launching authority popup This patch simply switches to a GET as the operation is not cud To test: 1 - Go to cataloging -> new record 2 - If not in basic editor, switch 3 - Go to tab 100 4 - Enter a name that has no authority in your system: McNotExist, Falsy 5 - Click 'Link authorities automatically' 6 - subfield 9 should turn red, and have an X and a + button 7 - Click the green + 8 - Boom 9 - Apply patch 10 - Reload page and repeat (clear cache so js reloads) 11 - Success! Authority window launches Signed-off-by: Jake Deery <jake.deery@ptfs-europe.com> Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |emily.lamancusa@montgomeryc | |ountymd.gov Status|Signed Off |Passed QA QA Contact|testopia@bugs.koha-communit |emily.lamancusa@montgomeryc |y.org |ountymd.gov -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 --- Comment #7 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Fixed this QA script complaint: FAIL koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt FAIL forbidden patterns forbidden pattern: simple-quote string (line 2461) data-confirmation-msg="[% t('Are you sure you want to delete this report?') This is about translations. Some languages (French?) need to use the ' in their words, so they would break the JavaScript. There is an existing coding guideline to wrap all translatable strings into double quotes to avoid that issue. So please don't ignore them :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |additional_work_needed --- Comment #8 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Hm, I fixed one occurence, but this confuses me too much, please provide a follow-up :) $("body").append('<div id="preview-sql-modal" tabindex="-1" role="dialog" aria-hidden="true" class="modal">\ <div class="modal-dialog">\ <div class="modal-content">\ <div class="modal-header" style="min-height:40px;">\ <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close">\ <span aria-hidden="true">×</span>\ </button>\ <h4 class="modal-title">' + title + '</h4>\ </div>\ <div class="modal-body"><textarea id="code' + reportid + '">' + message + '</textarea>\ </div>\ <div class="modal-footer">\ <a id="preview-modal-editreport" class="btn btn-default" href="/cgi-bin/koha/reports/guided_reports.pl?id=' + reportid + '&op=edit_form"><i class="fa-solid fa-pencil" aria-hidden="true"></i> ' + _("Edit") + '</a>\ <a id="preview-modal-duplicate" class="btn btn-default" href="/cgi-bin/koha/reports/guided_reports.pl?op=duplicate&id=' + reportid + '"><i class="fa fa-copy"></i> ' + _("Duplicate") + '</a>\ <a id="preview-modal-duplicate" class="btn btn-default" href="/cgi-bin/koha/tools/scheduler.pl?id=' + reportid + '"><i class="fa-solid fa-clock"></i> ' + _("Schedule") + '</a>\ <a class="btn btn-default submit-form-link" href="#" data-id="' + reportid + '" data-action="guided_reports.pl" data-method="post" data-op="cud-delete" data-confirmation-msg="' + _('Are you sure you want to delete this report?') + '"><i class="fa fa-trash-can"></i> Delete</a>\ <a id="preview-modal-runreport" class="btn btn-default" href="/cgi-bin/koha/reports/guided_reports.pl?id=' + reportid + '&op=run"><i class="fa fa-play"></i> ' + _("Run report") + '</a>\ <a href="#" id="preview-sql-modal-cancel" data-dismiss="modal" class="btn btn-default"><i class="fa fa-times" aria-hidden="true"></i> ' + _("Close") + '</a>\ </div>\ </div>\ </div>\ </div>'); -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 --- Comment #9 from Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> --- I think the above comments are meant for a different bug? This one doesn't touch guided_reports_start.tt or any translatable strings. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 --- Comment #10 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Thanks Emily, it's good I am on vacation next week (breaking all the things today...) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|additional_work_needed | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 --- Comment #11 from Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> --- No problem! I was worried it was me who was breaking things and forgetting to run the qa script for a minute :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |24.11.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 --- Comment #12 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.11! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable CC| |lucas@bywatersolutions.com Version(s)|24.11.00 |24.11.00,24.05.04 released in| | --- Comment #13 from Lucas Gass <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.04 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting CC| |fridolin.somers@biblibre.co | |m --- Comment #14 from Fridolin Somers <fridolin.somers@biblibre.com> --- Not for 23.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 Gretchen Maxeiner <maxeinergl@gcc.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |maxeinergl@gcc.edu -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37342 Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED CC| |caroline.cyr-la-rose@inlibr | |o.com Status|Needs documenting |RESOLVED --- Comment #15 from Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> --- Bug fix, nothing to add/edit in the manual. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org