Bug 31492 - Patron image upload fails on first attempt with CSRF failure
Summary: Patron image upload fails on first attempt with CSRF failure
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: master
Hardware: All All
: P5 - low normal with 20 votes (vote)
Assignee: Lucas Gass
QA Contact: Testopia
URL:
Keywords:
Depends on: 20809
Blocks:
  Show dependency treegraph
 
Reported: 2022-08-31 03:33 UTC by Matthew LS
Modified: 2023-12-28 20:44 UTC (History)
11 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.05.00,22.11.02,22.05.09, 21.11.16


Attachments
Bug 31492: Set CSRF token in circulation.pl (1.35 KB, patch)
2023-01-13 19:03 UTC, Lucas Gass
Details | Diff | Splinter Review
Bug 31492: Set CSRF token in circulation.pl (1.39 KB, patch)
2023-01-17 00:48 UTC, David Nind
Details | Diff | Splinter Review
Bug 31492: Set CSRF token in circulation.pl (1.45 KB, patch)
2023-01-17 04:58 UTC, David Cook
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Matthew LS 2022-08-31 03:33:33 UTC
After upgrading to 22.05.004 (and after manually installing `libmojolicious-plugin-openapi-perl` to get patron search to work - as per https://www.mail-archive.com/koha@lists.katipo.co.nz/msg28885.html) we are now seeing an issue uploading patron images.

After logging in to Koha, the first attempt to upload an individual patron image (from the patron show screen) fails with a CSRF error:

> The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.

Second and subsequent attempts succeed up until we log out and log back in again. After that the first submission once again fails.

I tailed the logs to see if I could see any errors using `tail -f /var/log/koha/library/*.log`. On one occasion I saw an error related to `picture_upload.pl` in `/var/log/koha/library/intranet-error.log` but I can't reproduce it.

In case it's relevant the error I saw once was:
> [Wed Aug 31 09:55:06.665314 2022] [cgi:error] [pid 288501] [client 136.228.129.94:64313] AH01215: Use of uninitialized value $cardnumber in concatenation (.) or string at /usr/share/koha/intranet/cgi-bin/tools/picture-upload.pl line 66.: /usr/share/koha/intranet/cgi-bin/tools/picture-upload.pl, referer: https://<library url>/cgi-bin/koha/circ/circulation.pl?borrowernumber=1790

The CSRF error in the client is reproducible in up-to-date versions of Chrome on Windows and Safari on macOS so it doesn't seem to be browser or OS specific.
Comment 1 Katrin Fischer 2022-09-11 14:02:37 UTC
I am seeing this issue on the master branch (current development) as well. Updating bug.

To test: 
* Turn on patronimages system preferences
* Go to any patron account
* Hover over the 'dummy image' for the Add button
* Browse and select an image for upload
* Saving results in the following error:

The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.
Comment 2 Jason Robb 2023-01-03 17:46:10 UTC
Not sure if this is the exact same issue but I'm on 22.05.07 and consistently getting the "Wrong CSRF Token" error any time I try to add a patron photo from any page of the account *other than* the Details (moremember.pl) tab.

I've tested with both the snazzy new camera integration and by manually uploading a file, and in both cases, it only succeeds on moremember.pl.
Comment 3 Wes 2023-01-05 01:14:17 UTC
I'm experiencing the same issue as Jason Robb. Works fine on moremember.pl but csrf_token is empty in the html on any of the other patron tab/pages.
Comment 4 Michael Adamyk 2023-01-05 21:13:13 UTC
Confirmed, I'm experiencing this issue after the 22.05 upgrade also.
Comment 5 Nick Clemens 2023-01-09 12:08:03 UTC Comment hidden (obsolete)
Comment 6 Lucas Gass 2023-01-13 19:03:46 UTC
Created attachment 145303 [details] [review]
Bug 31492: Set CSRF token in circulation.pl

To test:
* Turn on patronimages system preferences
* Go to any patron account
* Hover over the 'dummy image' for the Add button
* Browse and select an image for upload
* Saving results in the following error:

The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.

Apply patch and try again. You shouldn't need to try twice, it should work on the first attempt now.
Comment 7 David Nind 2023-01-17 00:48:17 UTC
Created attachment 145346 [details] [review]
Bug 31492: Set CSRF token in circulation.pl

To test:
* Turn on patronimages system preferences
* Go to any patron account
* Hover over the 'dummy image' for the Add button
* Browse and select an image for upload
* Saving results in the following error:

The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.

Apply patch and try again. You shouldn't need to try twice, it should work on the first attempt now.

Signed-off-by: David Nind <david@davidnind.com>
Comment 8 David Nind 2023-01-17 00:50:20 UTC
Testing notes (using koha-testing-docker):

1. No error when using Firefox (on Kubuntu 22.04). After apply patch, continues to work as expected.

2. Error when using Chromium and Google Chrome. Applying the patch successfully fixes the issue.
Comment 9 David Cook 2023-01-17 04:58:06 UTC
Created attachment 145347 [details] [review]
Bug 31492: Set CSRF token in circulation.pl

To test:
* Turn on patronimages system preferences
* Go to any patron account
* Hover over the 'dummy image' for the Add button
* Browse and select an image for upload
* Saving results in the following error:

The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.

Apply patch and try again. You shouldn't need to try twice, it should work on the first attempt now.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 10 Martin Renvoize 2023-01-18 15:50:01 UTC
Nice work everyone!

Pushed to 23.05.x for the next release
Comment 11 Jacob O'Mara 2023-01-18 17:05:44 UTC
Nice work, thanks everyone!

Pushed to 22.11.x for the next release.
Comment 12 Lucas Gass 2023-01-20 00:02:35 UTC
Backported to 22.05.x for upcoming 22.05.09
Comment 13 Arthur Suzuki 2023-01-26 13:11:47 UTC
applied to 21.11.x for 21.11.16
Comment 14 wainuiwitikapark 2023-03-15 01:34:17 UTC
Not backported to 21.05.x