[Bug 37093] New: 403 Forbidden Error when attempting to search for Mana Reports
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 Bug ID: 37093 Summary: 403 Forbidden Error when attempting to search for Mana Reports Change sponsored?: --- Product: Koha Version: 24.05 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Mana-kb Assignee: koha-bugs@lists.koha-community.org Reporter: kelly@bywatersolutions.com CC: alex.arnaud@biblibre.com We are running 24.05 and have found then when we attempt to search the Mana kb for a report, we are getting a 403 Forbidden Error. Steps to reproduce: 1. have mana set up 2. Go to reports, create a new report from mana 3. Use a term to search 4. receive a 403 forbidden error. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 Kelly McElligott <kelly@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jzairo@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 Kelly McElligott <kelly@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |critical -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|Mana-kb |Reports CC| |phil@chetcolibrary.org Severity|critical |major Depends on| |36192 --- Comment #1 from Phil Ringnalda <phil@chetcolibrary.org> --- That's because your search is sending a POST to /cgi-bin/koha/svc/mana/search without a CSRF token. https://git.koha-community.org/Koha-community/Koha/src/commit/10853d1edc9c31... is implicitly a POST because it passes an object to .load, but before bug 22250 cleaned things up in https://git.koha-community.org/Koha-community/Koha/commit/679fdaebb1a611859a... it was explicitly a POST (which bizarrely attempted to include a biblionumber, which makes it look like it was originally poorly-chosen copy-paste). That line should instead be $("#mana_result_content").load("/cgi-bin/koha/svc/mana/search #mana_results", "resource=report&usecomments=1&id=" + textquery, function( response, status, xhr ) { That nicely returns results from the search, but were the results ever usable? What I get seems to be the result of replacing newlines with '' rather than with ' ' which garbles everything since it does things like "i.ccodeFROM old_reserves oLEFT JOIN items i" and the SQL parser chokes at oLEFT. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 --- Comment #2 from Phil Ringnalda <phil@chetcolibrary.org> --- Inconveniently placed line wrapping by Bugzilla, but "result of replacing newlines with nothing, rather than with a single space" is Ye Olde bug 24773. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 --- Comment #3 from Phil Ringnalda <phil@chetcolibrary.org> --- Created attachment 168809 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168809&action=edit Bug 37093: Searching for reports on Mana should use GET Searching for reports on Mana currently fails by sending a POST to svc/mana/search without a CSRF token. There's no reason to POST, it's just sending a search string. 1. Enable Mana: Reports - lower right is a blue Knowledgebase box with a link to Change your Mana KB settings 2. Switch Use Mana KB to Yes, click Save, below that give it a name and email, Send to Mana KB 3. Reports - Use saved - New report - New SQL from Mana 4. Enter any keyword to search, get a 403 forbidden error 5. Apply patch, restart_all, Shift+Reload the page to clear cache 6. Enter any keyword likely to return results, like select, get results -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff Assignee|koha-bugs@lists.koha-commun |phil@chetcolibrary.org |ity.org | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 --- Comment #4 from Phil Ringnalda <phil@chetcolibrary.org> --- And once I actually read the line about "Your Mana KB server is currently: https://mana-test.koha-community.org" the broken newline conversion could well be only on the test server, dunno. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |Academy, Sandbox CC| |david@davidnind.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168809|0 |1 is obsolete| | --- Comment #5 from David Nind <david@davidnind.com> --- Created attachment 169920 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169920&action=edit Bug 37093: Searching for reports on Mana should use GET Searching for reports on Mana currently fails by sending a POST to svc/mana/search without a CSRF token. There's no reason to POST, it's just sending a search string. 1. Enable Mana: Reports - lower right is a blue Knowledgebase box with a link to Change your Mana KB settings 2. Switch Use Mana KB to Yes, click Save, below that give it a name and email, Send to Mana KB 3. Reports - Use saved - New report - New SQL from Mana 4. Enter any keyword to search, get a 403 forbidden error 5. Apply patch, restart_all, Shift+Reload the page to clear cache 6. Enter any keyword likely to return results, like select, get results Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This fixes searching for release notes| |reports from Mana when | |creating a new report. | |Searching was generating an | |error message: "Your search | |could not be completed. | |Please try again later. 403 | |Forbidden". (This is | |related to the CSRF changes | |added in Koha 24.05 to | |improve form security.) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the|This fixes searching for |This fixes creating a new release notes|reports from Mana when |report from Mana. Searching |creating a new report. |for a report was generating |Searching was generating an |an error message: "Your |error message: "Your search |search could not be |could not be completed. |completed. Please try again |Please try again later. 403 |later. 403 Forbidden". |Forbidden". (This is |(This is related to the |related to the CSRF changes |CSRF changes added in Koha |added in Koha 24.05 to |24.05 to improve form |improve form security.) |security.) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #169920|0 |1 is obsolete| | --- Comment #6 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Created attachment 169922 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169922&action=edit Bug 37093: Searching for reports on Mana should use GET Searching for reports on Mana currently fails by sending a POST to svc/mana/search without a CSRF token. There's no reason to POST, it's just sending a search string. 1. Enable Mana: Reports - lower right is a blue Knowledgebase box with a link to Change your Mana KB settings 2. Switch Use Mana KB to Yes, click Save, below that give it a name and email, Send to Mana KB 3. Reports - Use saved - New report - New SQL from Mana 4. Enter any keyword to search, get a 403 forbidden error 5. Apply patch, restart_all, Shift+Reload the page to clear cache 6. Enter any keyword likely to return results, like select, get results Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the|This fixes creating a new | release notes|report from Mana. Searching | |for a report was generating | |an error message: "Your | |search could not be | |completed. Please try again | |later. 403 Forbidden". | |(This is related to the | |CSRF changes added in Koha | |24.05 to improve form | |security.) | Status|Signed Off |Passed QA CC| |victor@tuxayo.net --- Comment #7 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Works, makes sense, QA script happy, code looks good, passing QA :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact| |victor@tuxayo.net CC| |martin.renvoize@ptfs-europe | |.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This fixes searching for a release notes| |report in Mana when | |creating a new report. | |Searching Mana was | |generating an error message | |"Your search could not be | |completed. Please try again | |later. 403 Forbidden". | |(This is related to the | |CSRF changes added in Koha | |24.05 to improve form | |security.) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|Academy, Sandbox | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |24.11.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 --- Comment #8 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.11! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 CJ Lynce <cj.lynce@westlakelibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |cj.lynce@westlakelibrary.or | |g --- Comment #9 from CJ Lynce <cj.lynce@westlakelibrary.org> --- Can this be backported to 24.05? We use mana regularly. Thx! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable CC| |lucas@bywatersolutions.com Version(s)|24.11.00 |24.11.00,24.05.04 released in| | --- Comment #10 from Lucas Gass <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.04 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting CC| |fridolin.somers@biblibre.co | |m --- Comment #11 from Fridolin Somers <fridolin.somers@biblibre.com> --- Not for 23.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37093 Bug 37093 depends on bug 36192, which changed state. Bug 36192 Summary: [OMNIBUS] CSRF Protection for Koha https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org