[Bug 38275] New: Unable to delete patron card creator images
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 Bug ID: 38275 Summary: Unable to delete patron card creator images Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Tools Assignee: Laura.escamilla@bywatersolutions.com Reporter: Laura.escamilla@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org To recreate: 1. Go to Tools > Patron Card Creator > New Image (or Manage Images) 2. Upload a photo to the image manager if one does not already exist 3. On the table labeled "Delete Images" attempt to delete the image using the "Delete" button, or try using the checkbox and "Delete selected" button. Neither method deletes the image. Instead you get the following error: "WARNING: An unsupported operation was attempted. Please have your system administrator check the error log for details." The logs show: "Image upload interface called an unsupported operation: delete at /usr/share/koha/intranet/cgi-bin/patroncards/image-manage.pl line 158." -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 --- Comment #1 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 173397 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=173397&action=edit Bug 38275: Remove "cud" from delete To test: 1. Go to Tools > Patron Card Creator > New Image (or Manage Images) 2. Upload a photo to the image manager if one does not already exist 3. On the table labeled "Delete Images" attempt to delete the image using the "Delete" button, or try using the checkbox and "Delete selected" button. Neither method deletes the image. Instead you get the following error: "WARNING: An unsupported operation was attempted. Please have your system administrator check the error log for details." 4. Apply patch and restart_all 5. Upload more images to the image manager 6. Delete one image using the “Delete button”. The deletion is successful. 7. Use the checkboxes to select the remaining images that you want to delete. Click on “Delete selected” at the bottom of the table. All selected images are now deleted. 8. Sign off and have an amazing day! :D -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 --- Comment #2 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 173398 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=173398&action=edit Bug 38275: Ensure that the script block is loaded after the HTML elements are available. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #173397|0 |1 is obsolete| | --- Comment #3 from David Nind <david@davidnind.com> --- Created attachment 173407 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=173407&action=edit Bug 38275: Remove "cud" from delete Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #173398|0 |1 is obsolete| | --- Comment #4 from David Nind <david@davidnind.com> --- Created attachment 173408 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=173408&action=edit Bug 38275: Ensure that the script block is loaded after the HTML elements are available. Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com Depends on| |36192 Text to go in the| |This fixes deleting images release notes| |when using the image | |manager for the patron card | |creator. You could not | |delete images, and received | |an error message "WARNING: | |An unsupported operation | |was attempted. Please have | |your system administrator | |check the error log for | |details." (This is related | |to the CSRF changes added | |in Koha 24.05 to improve | |form security.) Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the|This fixes deleting images |This fixes deleting images release notes|when using the image |when using the patron card |manager for the patron card |creator's image manager. |creator. You could not |You could not delete |delete images, and received |images, and received an |an error message "WARNING: |error message "WARNING: An |An unsupported operation |unsupported operation was |was attempted. Please have |attempted. Please have your |your system administrator |system administrator check |check the error log for |the error log for details." |details." (This is related |(This is related to the |to the CSRF changes added |CSRF changes added in Koha |in Koha 24.05 to improve |24.05 to improve form |form security.) |security.) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com, | |phil@chetcolibrary.org --- Comment #5 from Phil Ringnalda <phil@chetcolibrary.org> --- That's one messed-up CSRF-protection avoiding page: it has a form, with method="post" and op="cud-delete" just like anything doing a delete should, but then the submit button doesn't submit the form, it just concatenates the selected_images together and sticks them on a GET of ?op=delete. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=38277 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA CC| |dcook@prosentient.com.au --- Comment #6 from David Cook <dcook@prosentient.com.au> --- (In reply to Phil Ringnalda from comment #5)
That's one messed-up CSRF-protection avoiding page: it has a form, with method="post" and op="cud-delete" just like anything doing a delete should, but then the submit button doesn't submit the form, it just concatenates the selected_images together and sticks them on a GET of ?op=delete.
Good spotting, Phil. In this case, you should mark this bug as Failed QA. (Note: anyone can mark a bug as Failed QA.) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #173407|0 |1 is obsolete| | Attachment #173408|0 |1 is obsolete| | --- Comment #7 from David Cook <dcook@prosentient.com.au> --- Created attachment 173419 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=173419&action=edit Bug 38275: Fix patron card creator image delete This change changes the patron card creator image delete from a GET to a POST, and supports single delete and multi-delete. Test plan: 1. Apply the patch (and refresh browser JS cache) 2. Go to http://localhost:8081/cgi-bin/koha/patroncards/image-manage.pl 3. Upload multiple images 4. Select all the images using the checkboxes 5. Delete one image using the "Delete" button in the row 6. Note that only the image selected using the "Delete" button is deleted and the other images are de-selected 7. Delete multiple images using the "Delete selected" button 8. Note that the correct images are noted in the confirm message, and the correct images are deleted -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|Laura.escamilla@bywatersolu |dcook@prosentient.com.au |tions.com | --- Comment #8 from David Cook <dcook@prosentient.com.au> --- (In reply to Phil Ringnalda from comment #5)
That's one messed-up CSRF-protection avoiding page: it has a form, with method="post" and op="cud-delete" just like anything doing a delete should, but then the submit button doesn't submit the form, it just concatenates the selected_images together and sticks them on a GET of ?op=delete.
Apologies for taking this one over. As Phil notes, this stateful (CUD) operation needs to be done with a POST. I used Phil's idea of leveraging the existing POST form. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #173419|0 |1 is obsolete| | --- Comment #9 from David Nind <david@davidnind.com> --- Created attachment 173420 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=173420&action=edit Bug 38275: Fix patron card creator image delete This change changes the patron card creator image delete from a GET to a POST, and supports single delete and multi-delete. Test plan: 1. Apply the patch (and refresh browser JS cache) 2. Go to http://localhost:8081/cgi-bin/koha/patroncards/image-manage.pl 3. Upload multiple images 4. Select all the images using the checkboxes 5. Delete one image using the "Delete" button in the row 6. Note that only the image selected using the "Delete" button is deleted and the other images are de-selected 7. Delete multiple images using the "Delete selected" button 8. Note that the correct images are noted in the confirm message, and the correct images are deleted Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 Martin Renvoize (ashimema) <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com QA Contact|testopia@bugs.koha-communit |martin.renvoize@ptfs-europe |y.org |.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 Martin Renvoize (ashimema) <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #173420|0 |1 is obsolete| | --- Comment #10 from Martin Renvoize (ashimema) <martin.renvoize@ptfs-europe.com> --- Created attachment 173434 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=173434&action=edit Bug 38275: Fix patron card creator image delete This change changes the patron card creator image delete from a GET to a POST, and supports single delete and multi-delete. Test plan: 1. Apply the patch (and refresh browser JS cache) 2. Go to http://localhost:8081/cgi-bin/koha/patroncards/image-manage.pl 3. Upload multiple images 4. Select all the images using the checkboxes 5. Delete one image using the "Delete" button in the row 6. Note that only the image selected using the "Delete" button is deleted and the other images are de-selected 7. Delete multiple images using the "Delete selected" button 8. Note that the correct images are noted in the confirm message, and the correct images are deleted Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 Martin Renvoize (ashimema) <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |24.11.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 --- Comment #11 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.11! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com Version(s)|24.11.00 |24.11.00,24.05.06 released in| | Status|Pushed to main |Pushed to stable --- Comment #12 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.06 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Status|Pushed to oldstable |Needs documenting --- Comment #13 from Fridolin Somers <fridolin.somers@biblibre.com> --- Not for 23.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 Bug 38275 depends on bug 36192, which changed state. Bug 36192 Summary: [OMNIBUS] CSRF Protection for Koha https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38275 Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |caroline.cyr-la-rose@inlibr | |o.com Resolution|--- |FIXED Status|Needs documenting |RESOLVED --- Comment #14 from Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> --- Bug fix, nothing to add/edit in the manual. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org