[Bug 39317] New: Saving a letter template leads to a CSRF error
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 Bug ID: 39317 Summary: Saving a letter template leads to a CSRF error Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Notices Assignee: koha-bugs@lists.koha-community.org Reporter: baptiste.wojtkowski@biblibre.com QA Contact: testopia@bugs.koha-community.org STEPS TO REPRODUCE: 1 - go to /cgi-bin/koha/tools/letter.pl 2 - click on New notice -> claim serial issue (or any other one) 3 - Fill required fields with random string 4 - Save -> KABOOM -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |baptiste.wojtkowski@biblibr |ity.org |e.com -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 --- Comment #1 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 179206 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179206&action=edit Bug 39317: Fix CSRF protection for letters TEST PLAN: 1 - go to /cgi-bin/koha/tools/letter.pl 2 - click on New notice -> claim serial issue (or any other one) 3 - Fill required fields with random string 4 - Save -> KABOOM 5 - Apply patch 6 - Repeat 1-4 and see it works now -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 --- Comment #2 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- I'm a bit disappointed because the promised Kaboom doesn't appear on every install :'( However there is an issue with the action submitted in post, which is by default the one which lead to the form, and which is incorrect. I'm updating the test plan -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Saving a letter template |Saving a letter template |leads to a CSRF error |leads to a CSRF error on | |some installs -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Saving a letter template |Saving a letter template |leads to a CSRF error on |can lead to a CSRF error on |some installs |some installs -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179206|0 |1 is obsolete| | --- Comment #3 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 179209 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179209&action=edit Bug 39317: Fix CSRF protection for letters TEST PLAN: 1 - go to /cgi-bin/koha/tools/letter.pl 2 - click on New notice -> claim serial issue (or any other one) 3 - Fill required fields with random string 4 - Save -> if it breaks, go to 5 - Open a network panel (F12 -> network) 6 - Filter on letter.pl 7 - Fill another new notice -> the arguments of the form page have been passed in the address of the POST request. 8 - Apply patch 9 - Repeat the whole process and see it works now -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com --- Comment #4 from David Nind <david@davidnind.com> --- I tried several times, with different browsers, and couldn't get a KABOOM. Hopefully someone else is more lucky! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 --- Comment #5 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- (In reply to David Nind from comment #4)
I tried several times, with different browsers, and couldn't get a KABOOM.
Hopefully someone else is more lucky!
I submitted a plan to test it without crash, see https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317#c3 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 --- Comment #6 from David Nind <david@davidnind.com> --- (In reply to Baptiste Wojtkowski (bwoj) from comment #5)
(In reply to David Nind from comment #4)
I tried several times, with different browsers, and couldn't get a KABOOM.
Hopefully someone else is more lucky!
I submitted a plan to test it without crash, see https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317#c3
Sorry, I still can't produce an error. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 Magnus Enger <magnus@libriotech.no> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |magnus@libriotech.no --- Comment #7 from Magnus Enger <magnus@libriotech.no> --- No KABOOM for me either. What is the reasoning behind this patch? Is the action attribute required for the CSRF protection to work? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |phil@chetcolibrary.org --- Comment #8 from Phil Ringnalda <phil@chetcolibrary.org> --- Sounds like the missing Step 0 would be to install a reverse proxy in front of Koha which does something dubious when it sees a POST to a URL with a query string. Is it converting the POST to a GET, or stuffing the params in the query string into the POST body? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #9 from David Cook <dcook@prosentient.com.au> --- Does the patch solve your problem? I don't love form elements without action attributes, so it seems like a reasonable change in general to me. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 --- Comment #10 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- In my case ? Yup -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 Magnus Enger <magnus@libriotech.no> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 Magnus Enger <magnus@libriotech.no> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179209|0 |1 is obsolete| | --- Comment #11 from Magnus Enger <magnus@libriotech.no> --- Created attachment 180818 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=180818&action=edit Bug 39317: Fix CSRF protection for letters TEST PLAN: 1 - go to /cgi-bin/koha/tools/letter.pl 2 - click on New notice -> claim serial issue (or any other one) 3 - Fill required fields with random string 4 - Save -> if it breaks, go to 5 - Open a network panel (F12 -> network) 6 - Filter on letter.pl 7 - Fill another new notice -> the arguments of the form page have been passed in the address of the POST request. 8 - Apply patch 9 - Repeat the whole process and see it works now Signed-off-by: Magnus Enger <magnus@libriotech.no> I can't recreate the problem, but the change seems sensible enough and does not seem to introduce a regression, I can still save a new letter/notice. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 --- Comment #12 from David Cook <dcook@prosentient.com.au> --- I'll look at QAing this soon. As Phil said, I wonder if this is something that Baptiste has noticed on BibLibre installs which run behind Nginx I believe? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |dcook@prosentient.com.au |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #180818|0 |1 is obsolete| | --- Comment #13 from David Cook <dcook@prosentient.com.au> --- Created attachment 180893 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=180893&action=edit Bug 39317: Fix CSRF protection for letters TEST PLAN: 1 - go to /cgi-bin/koha/tools/letter.pl 2 - click on New notice -> claim serial issue (or any other one) 3 - Fill required fields with random string 4 - Save -> if it breaks, go to 5 - Open a network panel (F12 -> network) 6 - Filter on letter.pl 7 - Fill another new notice -> the arguments of the form page have been passed in the address of the POST request. 8 - Apply patch 9 - Repeat the whole process and see it works now Signed-off-by: Magnus Enger <magnus@libriotech.no> I can't recreate the problem, but the change seems sensible enough and does not seem to introduce a regression, I can still save a new letter/notice. Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 --- Comment #14 from David Cook <dcook@prosentient.com.au> --- I couldn't reproduce the problem either, but it's a sensible change (ie improvement) to make and it works. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |25.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 --- Comment #15 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 25.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |rel_24_11_candidate CC| |julian.maurice@biblibre.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Version(s)|25.05.00 |25.05.00,24.11.10 released in| | Status|Pushed to main |Pushed to stable --- Comment #16 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to 24.11.x for 24.11.10 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting --- Comment #17 from Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> --- Not backporting to 22.11.x as it wasn't backported to 24.05.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39317 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED Resolution|--- |FIXED --- Comment #18 from David Nind <david@davidnind.com> --- Bug fix, no changes to the manual required. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org