[Bug 38378] New: Can't delete frequencies due to stray cud- in del op
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 Bug ID: 38378 Summary: Can't delete frequencies due to stray cud- in del op Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Serials Assignee: koha-bugs@lists.koha-community.org Reporter: lmstrand@gmail.com QA Contact: testopia@bugs.koha-community.org serials/subscription-frequencies.pl has a delete op that was changed to cud-del when it shouldn't have been. This breaks the delete button's function. Existing subscription frequencies cannot be deleted and the button does nothing. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 --- Comment #1 from Lari Strand <lmstrand@gmail.com> --- Created attachment 174076 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=174076&action=edit Bug 38378: Can't delete frequencies due to stray cud- in del op -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 Lari Strand <lmstrand@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #174076|0 |1 is obsolete| | --- Comment #2 from Lari Strand <lmstrand@gmail.com> --- Created attachment 174077 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=174077&action=edit Bug 38378: Can't delete frequencies due to stray cud- in del op serials/subscription-frequencies.pl has a delete op that was changed to cud-del when it shouldn't have been. This breaks the delete button's function. Existing subscription frequencies cannot be deleted and the button does nothing. This patch fixess the issue. Test plan: 1. Serials - Manage frequencies - for any frequency click Delete, create one if needed 2. Note that the frequency can't be deleted 3. Apply patch, restart_all 4. Repeat step 1, note that now the deletion works -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |phil@chetcolibrary.org --- Comment #3 from Phil Ringnalda <phil@chetcolibrary.org> --- That would then break deleting a frequency that is in use, which returns a page saying it is in use and asks for a confirmation that you want to delete it, and if you do, POSTs with op=cud-del. It is a cud- op, the d is for delete, and it should require a POST. The problem is that the link for the first attempt at deleting is doing a GET with just op=del. Two possible solutions for that: either the link needs to use submit-form-link to POST (probably with a data-confirmation-msg, it's a bit sketchy that you can delete an unused frequency with no confirmation at all), or the ops need to be reworked into a GET of delete-confirm which returns a page that says whether or not the frequency is in use and asks for confirmation either way and POSTS to cud-delete. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Can't delete frequencies |Can't delete frequencies |due to stray cud- in del op |due to GET of ?op=del Status|NEW |CONFIRMED -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #4 from David Cook <dcook@prosentient.com.au> --- +1 to what Phil said. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Can't delete frequencies |Serial frequency deletion |due to GET of ?op=del |needs to be converted to | |POST from GET --- Comment #5 from David Cook <dcook@prosentient.com.au> --- Going to change the title of this one -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 --- Comment #6 from Lari Strand <lmstrand@gmail.com> --- Ok I get it. I don't think I have what it takes to fix this one as Phil suggested :D. Please someone take over. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 Lari Strand <lmstrand@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|CONFIRMED |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 --- Comment #7 from Lari Strand <lmstrand@gmail.com> --- Created attachment 174195 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=174195&action=edit Bug 38378: Serial frequency deletion needs to be converted to POST from GET Deleting frequencies and checking if they are used by a subscription is broken. This patch fixes the issue. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 --- Comment #8 from Lari Strand <lmstrand@gmail.com> --- Created attachment 174231 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=174231&action=edit Bug 38378: Serial frequency deletion needs to be converted to POST from GET Deleting frequencies and checking if they are used by a subscription is broken. This patch fixes the issue. Test plan: 1. Serials - Manage frequencies - for any frequency click Delete, create one if needed 2. Note that the frequency can't be deleted 3. Apply patch, restart_all 4. Repeat step 1, note that now the deletion works 5. Serials - Manage frequencies - create one 6. Create a subscription in serials that uses the created frequency 7. Try to delete the created frequency 8. Note that nothing happens 9. Apply patch, restart all 10. Repeat step 7, note that now Koha tells you if the frequency is in use by a subscription/subscriptions and when you confirm deletion the frequency gets removed -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 --- Comment #9 from Lari Strand <lmstrand@gmail.com> --- Somehow the older patches did not get obsoleted by git bz and I can't figure out why. Sorry for that. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #174077|0 |1 is obsolete| | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA --- Comment #10 from David Cook <dcook@prosentient.com.au> --- Take a look at some other examples and you'll get the idea. Here's some I did: commit 5d3b7cf08949d5776b732f24cefcbe377260c281 commit 47d6725a722728c5d0ae38953a0d8c74d99d3d9e However, Owen does it much better on the "Manage numbering patterns" page: commit 7dc1b9e95436452d2008bce17aa88df6496064a6 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=38309 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 --- Comment #11 from David Cook <dcook@prosentient.com.au> --- It looks like "Manage subscription fields" was just fixed by bug 38309. You can do it! -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 --- Comment #12 from David Cook <dcook@prosentient.com.au> --- (In reply to David Cook from comment #11)
You can do it!
That's me trying to sound encouraging and not demanding ;). You've got this. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 --- Comment #13 from Phil Ringnalda <phil@chetcolibrary.org> --- Yeah, avoid those more complicated early-on examples of jamming a form into the space where a link was, submit-form-link is The Way :) Once you have one to copy-paste from, it really doesn't take much: - If the template doesn't already have one, add [% USE Asset %] up top - If the template doesn't already have one, down in the [% MACRO jsinclude BLOCK %] at the bottom add [% Asset.js("js/form-submit.js") | $raw %] which is what does all the hard work for you - Add the class submit-form-link to the link - Replace the href attribute with "#" - Put the path and filename from the href in a data-action attribute - Add a data-method="post" attribute - For all the paramters after the ? in the original href, add an attribute where the name is 'data-' plus the key, and the value is the value, so href="?goats=fun" becomes data-goats="fun". And that's where you need to change the ?op=del to data-op=cud-del, because there shouldn't be an op named del which does deletion - If you need a confirmation alert (and you do, for delete), add data-confirmation-msg="[% t('Really?!?') | html %] only with better text than Really?!?, typically 'Are you sure you want to delete this frequency?' -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 --- Comment #14 from Phil Ringnalda <phil@chetcolibrary.org> --- The always-unobvious steps to obsolete a patch manually in Bugzilla are to click the Details link to the right of the patch, then at the end of the patch summary line where it's easy to miss is a (edit details) link that gives you a checkbox to obsolete. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 --- Comment #15 from David Cook <dcook@prosentient.com.au> --- Yes! Thank you, Phil! Legend! I was searching for bug 36246 (using keywords) and I just couldn't find it. I think I like Owen's from commit 7dc1b9e95436452d2008bce17aa88df6496064a6 best but bug 36246 is what I was trying to find as an example of what folk have been trying to do. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #174195|0 |1 is obsolete| | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #174231|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |phil@chetcolibrary.org |ity.org | Priority|P5 - low |P3 Depends on| |36192 Status|Failed QA |ASSIGNED --- Comment #16 from Phil Ringnalda <phil@chetcolibrary.org> --- I don't think we were sufficiently persuasive about how easy it would be, taking. Now that I actually looked at the page, where these are already links pretending to be buttons, just wrap it in a form and turn it into a real button is the right solution here. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 --- Comment #17 from Phil Ringnalda <phil@chetcolibrary.org> --- Created attachment 174309 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=174309&action=edit Bug 38378: Serial frequency deletion needs to be converted to POST from GET Deleting a serial frequency is (or can be) a two step process. If you are deleting a frequency which is in use, you get back a page warning you that it is in use, which the CSRF changes converted to a form POSTing with a CSRF token and the new op cud-del. However, to get there you have to go through the step that's the only step if the frequency isn't in use, clicking a link that still thinks the op is named del rather than cud-del. That link needs to instead be a form with a CSRF token and a POST of cud-del. Test plan: 1. Without the patch, Serials - Manage frequencies 2. For any frequency, click Delete, click OK in the confirmation popup 3. Nothing happened except your URL changing, the frequency is still there 4. Apply patch, reload Manage frequencies 5. For any frequency, click Delete, click OK in the confirmation popup 6. This time, your frequency was deleted Sponsored-by: Chetco Community Public Library -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #174309|0 |1 is obsolete| | --- Comment #18 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 174434 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=174434&action=edit Bug 38378: Serial frequency deletion needs to be converted to POST from GET Deleting a serial frequency is (or can be) a two step process. If you are deleting a frequency which is in use, you get back a page warning you that it is in use, which the CSRF changes converted to a form POSTing with a CSRF token and the new op cud-del. However, to get there you have to go through the step that's the only step if the frequency isn't in use, clicking a link that still thinks the op is named del rather than cud-del. That link needs to instead be a form with a CSRF token and a POST of cud-del. Test plan: 1. Without the patch, Serials - Manage frequencies 2. For any frequency, click Delete, click OK in the confirmation popup 3. Nothing happened except your URL changing, the frequency is still there 4. Apply patch, reload Manage frequencies 5. For any frequency, click Delete, click OK in the confirmation popup 6. This time, your frequency was deleted Sponsored-by: Chetco Community Public Library Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=29818 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #174434|0 |1 is obsolete| | --- Comment #19 from David Cook <dcook@prosentient.com.au> --- Created attachment 174444 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=174444&action=edit Bug 38378: Serial frequency deletion needs to be converted to POST from GET Deleting a serial frequency is (or can be) a two step process. If you are deleting a frequency which is in use, you get back a page warning you that it is in use, which the CSRF changes converted to a form POSTing with a CSRF token and the new op cud-del. However, to get there you have to go through the step that's the only step if the frequency isn't in use, clicking a link that still thinks the op is named del rather than cud-del. That link needs to instead be a form with a CSRF token and a POST of cud-del. Test plan: 1. Without the patch, Serials - Manage frequencies 2. For any frequency, click Delete, click OK in the confirmation popup 3. Nothing happened except your URL changing, the frequency is still there 4. Apply patch, reload Manage frequencies 5. For any frequency, click Delete, click OK in the confirmation popup 6. This time, your frequency was deleted Sponsored-by: Chetco Community Public Library Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |dcook@prosentient.com.au |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Serial frequency deletion |Serial frequency deletion |needs to be converted to |is broken |POST from GET | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |24.11.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 --- Comment #20 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.11! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|24.11.00 |24.11.00,24.05.06 released in| | CC| |lucas@bywatersolutions.com Status|Pushed to main |Pushed to stable --- Comment #21 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.06 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Status|Pushed to oldstable |Needs documenting --- Comment #22 from Fridolin Somers <fridolin.somers@biblibre.com> --- Not for 23.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED Resolution|--- |FIXED --- Comment #23 from Phil Ringnalda <phil@chetcolibrary.org> --- No interface changes to document, just a bugfix. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 Bug 38378 depends on bug 36192, which changed state. Bug 36192 Summary: [OMNIBUS] CSRF Protection for Koha https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org