[Bug 37111] New: OPAC renewal - CSRF "op must be set"
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Bug ID: 37111 Summary: OPAC renewal - CSRF "op must be set" Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: OPAC Assignee: oleonard@myacpl.org Reporter: david@davidnind.com QA Contact: testopia@bugs.koha-community.org In the OPAC, when a patron clicks the "renew" link for an item they get an error: op must be set at /kohadevbox/koha/opac/opac-renew.pl line 36 in (eval) at /kohadevbox/koha/opac/opac-renew.pl line 36 33: my $query = CGI->new; 34: my $op = $query->param('op') || q{}; 35: 36: die "op must be set" unless $op eq 'cud-renew'; ... To replicate (using KTD): 1. Check some items out to a patron 2. Set the username and apssword for the patron so that you can log in as that patron. 3. Log in to the OAPC as that patron. 4. Go to Your account > Summary (the default landing page after you log in). 5. Click "Renew" for one of the items. 6. You get the error as above. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |36192 Depends on| |34478 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 [Bug 34478] Full CSRF protection https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Alexander Wagner <alexander.wagner@desy.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |alexander.wagner@desy.de --- Comment #1 from Alexander Wagner <alexander.wagner@desy.de> --- It seems the error results from l.456 in [`opac.tt`](https://github.com/Koha-Community/Koha/blob/8ab3989654b900cef2954c469b12ddce...) where the URL generated does not add the missing parameter. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 --- Comment #2 from Lucas Gass <lucas@bywatersolutions.com> --- Created attachment 167860 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167860&action=edit Bug 37111: Turn Renew link into a POST form To test: 1. Check some items out to a patron 2. Set the username and apssword for the patron so that you can log in as that patron. 3. Log in to the OAPC as that patron. 4. Go to Your account > Summary (the default landing page after you log in). 5. Click "Renew" for one of the items. 6. You get the error as above. 7. APPLY PATCH 8. Try steps 1 -5 again, you should not get an error. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch Assignee|oleonard@myacpl.org |lucas@bywatersolutions.com CC| |lucas@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 --- Comment #3 from Lucas Gass <lucas@bywatersolutions.com> --- I think the link to renew needs to be a POST form. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA --- Comment #4 from David Nind <david@davidnind.com> --- Thanks Lucas for looking at this so quickly! If I tick the box and select "Renew selected" above the table header or at the bottom of the table, it works as expected. (No change from before the patch.) If I select "Renew all" above the table header or at the bottom of the table, I get a pop-up message, "Nothing has been selected. Check the box for each item you want to renew". (This was working before the patch.) If I click the "Renew" button for the individual item, I'm still getting the error. Also, is it possible to leave "Renew" in the table for an individual item as a text link? It looks quite big and out of place at the moment. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 --- Comment #5 from Owen Leonard <oleonard@myacpl.org> --- The whole table is wrapped in a <form> so you can't put individual forms inside the table. I think our most common solution for that is to but the "batch" form after the table and use JS to populate the selections. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nick@bywatersolutions.com See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=36246 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 --- Comment #6 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- (In reply to Owen Leonard from comment #5)
The whole table is wrapped in a <form> so you can't put individual forms inside the table. I think our most common solution for that is to but the "batch" form after the table and use JS to populate the selections.
We now have a method to submit a link as a form on bug 36246 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167860|0 |1 is obsolete| | --- Comment #7 from Lucas Gass <lucas@bywatersolutions.com> --- Created attachment 167866 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167866&action=edit Bug 37111: Add submit-form asset to OPAC assets -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 --- Comment #8 from Lucas Gass <lucas@bywatersolutions.com> --- Created attachment 167867 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167867&action=edit Bug 37111: Fix renew link on opac-user.tt To test: 1. Check some items out to a patron 2. Set the username and apssword for the patron so that you can log in as that patron. 3. Log in to the OAPC as that patron. 4. Go to Your account > Summary (the default landing page after you log in). 5. Click "Renew" for one of the items. 6. You get the error as above. 7. APPLY PATCH 8. Try steps 1 -5 again, you should not get an error. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 --- Comment #9 from Lucas Gass <lucas@bywatersolutions.com> --- Thanks everyone, new patchset submitted. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |36246 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36246 [Bug 36246] Have a centralized method for submitting a form via a link -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167866|0 |1 is obsolete| | --- Comment #10 from David Nind <david@davidnind.com> --- Created attachment 167869 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167869&action=edit Bug 37111: Add submit-form asset to OPAC assets Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167867|0 |1 is obsolete| | --- Comment #11 from David Nind <david@davidnind.com> --- Created attachment 167870 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167870&action=edit Bug 37111: Fix renew link on opac-user.tt To test: 1. Check some items out to a patron 2. Set the username and apssword for the patron so that you can log in as that patron. 3. Log in to the OAPC as that patron. 4. Go to Your account > Summary (the default landing page after you log in). 5. Click "Renew" for one of the items. 6. You get the error as above. 7. APPLY PATCH 8. Try steps 1 -5 again, you should not get an error. Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Alexander Wagner <alexander.wagner@desy.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167869|0 |1 is obsolete| | --- Comment #12 from Alexander Wagner <alexander.wagner@desy.de> --- Created attachment 167921 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167921&action=edit Bug 37111: Add submit-form asset to OPAC assets Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Alexander Wagner <alexander.wagner@desy.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Alexander Wagner <alexander.wagner@desy.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167870|0 |1 is obsolete| | --- Comment #13 from Alexander Wagner <alexander.wagner@desy.de> --- Created attachment 167922 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=167922&action=edit Bug 37111: Fix renew link on opac-user.tt To test: 1. Check some items out to a patron 2. Set the username and apssword for the patron so that you can log in as that patron. 3. Log in to the OAPC as that patron. 4. Go to Your account > Summary (the default landing page after you log in). 5. Click "Renew" for one of the items. 6. You get the error as above. 7. APPLY PATCH 8. Try steps 1 -5 again, you should not get an error. Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Alexander Wagner <alexander.wagner@desy.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 --- Comment #14 from Alexander Wagner <alexander.wagner@desy.de> --- Thanks for the quick fix! :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 --- Comment #15 from Lucas Gass <lucas@bywatersolutions.com> --- Created attachment 168103 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168103&action=edit Bug 37111: (follow-up) data attribute names should be lowercase See Bug 37190 Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|normal |major Keywords| |RM_priority --- Comment #16 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Adding RM_Priority - please QA as this affects end users. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA --- Comment #17 from Lucas Gass <lucas@bywatersolutions.com> --- This won't work as is because Bug 37190 was RESOLVED INVALID. I will make the necessary changes. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |phil@chetcolibrary.org --- Comment #18 from Phil Ringnalda <phil@chetcolibrary.org> --- Isn't the necessary change just to obsolete your followup patch? I applied the first two patches, added a data-confirmation-msg to the link, and it worked perfectly, submit-form.js saw it as confirmationMsg and asked the question and acted appropriately. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kyle@bywatersolutions.com --- Comment #19 from Kyle M Hall <kyle@bywatersolutions.com> --- (In reply to Phil Ringnalda (back in August) from comment #18)
Isn't the necessary change just to obsolete your followup patch? I applied the first two patches, added a data-confirmation-msg to the link, and it worked perfectly, submit-form.js saw it as confirmationMsg and asked the question and acted appropriately.
I've having no issues with or without the followup. It seems better to leave it off in that case. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #167921|0 |1 is obsolete| | Attachment #167922|0 |1 is obsolete| | Attachment #168103|0 |1 is obsolete| | --- Comment #20 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 169157 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169157&action=edit Bug 37111: Add submit-form asset to OPAC assets Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Alexander Wagner <alexander.wagner@desy.de> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 --- Comment #21 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 169158 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169158&action=edit Bug 37111: Fix renew link on opac-user.tt To test: 1. Check some items out to a patron 2. Set the username and apssword for the patron so that you can log in as that patron. 3. Log in to the OAPC as that patron. 4. Go to Your account > Summary (the default landing page after you log in). 5. Click "Renew" for one of the items. 6. You get the error as above. 7. APPLY PATCH 8. Try steps 1 -5 again, you should not get an error. Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Alexander Wagner <alexander.wagner@desy.de> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |kyle@bywatersolutions.com |y.org | CC| |martin.renvoize@ptfs-europe | |.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This fixes an error that release notes| |occurs when patron's | |attempt to renew items from | |their OPAC account (Your | |account > Summary). The | |error was related to the | |CSRF changes to improve the | |security for forms added | |Koha 24.05. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |24.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 --- Comment #22 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Thanks for all the hard work! Pushed to main for the next 24.11.00 release as RM Assistant -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|24.11.00 |24.11.00,24.05.04 released in| | Status|Pushed to main |Pushed to stable --- Comment #23 from Lucas Gass <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.04 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting CC| |fridolin.somers@biblibre.co | |m --- Comment #24 from Fridolin Somers <fridolin.somers@biblibre.com> --- Depends on Bug 34478 not in 23.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Bug 37111 depends on bug 36246, which changed state. Bug 36246 Summary: Have a centralized method for submitting a form via a link https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36246 What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Needs documenting |RESOLVED --- Comment #25 from David Nind <david@davidnind.com> --- Bug fix, no change to UI, no changes required to the documentation. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|RM_priority | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Bug 37111 depends on bug 34478, which changed state. Bug 34478 Summary: Full CSRF protection https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37111 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |39680 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39680 [Bug 39680] The navigation item "Clear” in search history doesn't delete searches -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org