Created attachment 54309 [details] [review] Bug 17109: Remove second authentication from (opac-)sendbasket Patch deals with opac and intranet variant. If we authenticated the first time, it is not necessary to do it a second time rightaway. Replaces a call to get_template_and_user (including checkauth) by gettemplate. Also removes duplicate use C4::Biblio statements. Test plan: [1] Put a few books in the cart. [2] Send the cart from OPAC. [3] Send the cart from intranet.
Created attachment 54310 [details] [review] Bug 17109: Add CSRF token to [opac-]sendbasket If you have no (valid) token, you will not be able to send the message. Test plan: [1] Verify if you can still send the cart from opac and intranet. [2] While still being logged in, try to send the cart from opac by using the following URL: /cgi-bin/koha/opac-sendbasket.pl?email_add=you@somedomain.com&comment=csrf_test&bib_list=doesnotmatter&csrf_token=justsomeguess12345 This should now result in a csrf error.
Created attachment 54325 [details] [review] Bug 17109: Use Koha.Preference in sendbasket template No need to send OPACBaseURL to the template, if you load the Koha TT plugin inside the template. Test plan: Send a few items in your cart from OPAC and intranet.
Created attachment 54470 [details] [review] Bug 17109: Remove second authentication from (opac-)sendbasket Patch deals with opac and intranet variant. If we authenticated the first time, it is not necessary to do it a second time rightaway. Replaces a call to get_template_and_user (including checkauth) by gettemplate. Also removes duplicate use C4::Biblio statements. Test plan: [1] Put a few books in the cart. [2] Send the cart from OPAC. [3] Send the cart from intranet. Tested 3 patches together. Works as expected. Signed-off-by: Marc Véron <veron@veron.ch>
Created attachment 54471 [details] [review] Bug 17109: Add CSRF token to [opac-]sendbasket If you have no (valid) token, you will not be able to send the message. Test plan: [1] Verify if you can still send the cart from opac and intranet. [2] While still being logged in, try to send the cart from opac by using the following URL: /cgi-bin/koha/opac-sendbasket.pl?email_add=you@somedomain.com&comment=csrf_test&bib_list=doesnotmatter&csrf_token=justsomeguess12345 This should now result in a csrf error. Signed-off-by: Marc Véron <veron@veron.ch>
Created attachment 54472 [details] [review] Bug 17109: Use Koha.Preference in sendbasket template No need to send OPACBaseURL to the template, if you load the Koha TT plugin inside the template. Test plan: Send a few items in your cart from OPAC and intranet. Signed-off-by: Marc Véron <veron@veron.ch>
Comment on attachment 54471 [details] [review] Bug 17109: Add CSRF token to [opac-]sendbasket Review of attachment 54471 [details] [review]: ----------------------------------------------------------------- ::: koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt @@ +20,5 @@ > [% END %] > > + [% IF csrf_error %] > + <p>No valid CSRF token!</p> > + <p><a class="focus close" href="#">Close window</a></p> If you do that here, I will have to do it in all other places (and really don't want to! :) ) Are you sure we really want to stylish it?
Created attachment 54503 [details] [review] Bug 17109: [QA Follow-up] Die when wrong token Removes template var csrf_error and associated handling. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Restested with opac and intranet: Still sends or dies elegantly..
(In reply to Jonathan Druart from comment #7) > If you do that here, I will have to do it in all other places (and really > don't want to! :) ) > Are you sure we really want to stylish it? No problem
Created attachment 54705 [details] [review] Bug 17109: Remove second authentication from (opac-)sendbasket Patch deals with opac and intranet variant. If we authenticated the first time, it is not necessary to do it a second time rightaway. Replaces a call to get_template_and_user (including checkauth) by gettemplate. Also removes duplicate use C4::Biblio statements. Test plan: [1] Put a few books in the cart. [2] Send the cart from OPAC. [3] Send the cart from intranet. Tested 3 patches together. Works as expected. Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Created attachment 54706 [details] [review] Bug 17109: Add CSRF token to [opac-]sendbasket If you have no (valid) token, you will not be able to send the message. Test plan: [1] Verify if you can still send the cart from opac and intranet. [2] While still being logged in, try to send the cart from opac by using the following URL: /cgi-bin/koha/opac-sendbasket.pl?email_add=you@somedomain.com&comment=csrf_test&bib_list=doesnotmatter&csrf_token=justsomeguess12345 This should now result in a csrf error. Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Created attachment 54707 [details] [review] Bug 17109: Use Koha.Preference in sendbasket template No need to send OPACBaseURL to the template, if you load the Koha TT plugin inside the template. Test plan: Send a few items in your cart from OPAC and intranet. Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Created attachment 54708 [details] [review] Bug 17109: [QA Follow-up] Die when wrong token Removes template var csrf_error and associated handling. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Restested with opac and intranet: Still sends or dies elegantly.. Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Pushed to master for 16.11, thanks Marcel!
Pushed to 16.05.x, for 16.05.12 release