Bug 35019 - Can't delete news from the staff interface main page
Summary: Can't delete news from the staff interface main page
Status: Pushed to oldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: Staff interface (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Emily-Rose Francoeur
QA Contact: Testopia
URL:
Keywords:
Depends on: 34368
Blocks:
  Show dependency treegraph
 
Reported: 2023-10-10 15:44 UTC by Emily-Rose Francoeur
Modified: 2023-11-13 14:20 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.11.00,23.05.05,22.11.12


Attachments
Bug 35019: Add a CSRF token when deleting news (2.89 KB, patch)
2023-10-10 17:26 UTC, Emily-Rose Francoeur
Details | Diff | Splinter Review
Bug 35019: Add a CSRF token when deleting news (2.79 KB, patch)
2023-10-10 17:33 UTC, Emily-Rose Francoeur
Details | Diff | Splinter Review
Bug 35019: Add a CSRF token when deleting news (2.84 KB, patch)
2023-10-11 13:28 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 35019: Add a CSRF token when deleting news (2.90 KB, patch)
2023-10-16 21:04 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Emily-Rose Francoeur 2023-10-10 15:44:06 UTC
It’s no longer possible to delete news entries from the homepage in the staff interface.

To reproduce the bug:
1) Go to “Tools > News > New entry”
2) “Display location” should be set to “Staff interface”
3) Fill in the fields
4) Return to the homepage
5) Try to delete the newly created news entry
6) The “Additional contents” page is displayed with the message “There are no additional contents.”
7) Return to the homepage; the news entry is not deleted.

The “Additional contents” page expects to receive a CSRF token, but none is sent, causing the issue.
Comment 1 Emily-Rose Francoeur 2023-10-10 17:26:38 UTC Comment hidden (obsolete)
Comment 2 Emily-Rose Francoeur 2023-10-10 17:33:26 UTC
Created attachment 156802 [details] [review]
Bug 35019: Add a CSRF token when deleting news

I add a CSRF token as a parameter in the link for deleting a news entry, which solves the problem.

TEST PLAN
1) Apply the patch
2) Go to "Tools > News > New entry"
3) "Display location" should be set to "Staff interface"
4) Fill in the fields
5) Return to the homepage
6) Delete the created news entry
7) The "Additional contents" page is displayed, and the deleted news entry no longer appears
8) Return to the homepage; the news entry no longer displays
Comment 3 Owen Leonard 2023-10-11 13:28:12 UTC
Created attachment 156822 [details] [review]
Bug 35019: Add a CSRF token when deleting news

I add a CSRF token as a parameter in the link for deleting a news
entry, which solves the problem.

TEST PLAN
1) Apply the patch
2) Go to "Tools > News > New entry"
3) "Display location" should be set to "Staff interface"
4) Fill in the fields
5) Return to the homepage
6) Delete the created news entry
7) The "Additional contents" page is displayed, and the deleted news
   entry no longer appears
8) Return to the homepage; the news entry no longer displays

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 4 Katrin Fischer 2023-10-16 21:04:30 UTC
Created attachment 157215 [details] [review]
Bug 35019: Add a CSRF token when deleting news

I add a CSRF token as a parameter in the link for deleting a news
entry, which solves the problem.

TEST PLAN
1) Apply the patch
2) Go to "Tools > News > New entry"
3) "Display location" should be set to "Staff interface"
4) Fill in the fields
5) Return to the homepage
6) Delete the created news entry
7) The "Additional contents" page is displayed, and the deleted news
   entry no longer appears
8) Return to the homepage; the news entry no longer displays

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 5 Tomás Cohen Arazi 2023-10-20 20:29:27 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 6 Fridolin Somers 2023-10-26 06:23:11 UTC
Pushed to 23.05.x for 23.05.05
Comment 7 David Cook 2023-10-26 21:43:37 UTC
On a side note, generally speaking, we want to avoid putting CSRF tokens in GET requests, and we want to avoid state changes via GET requests. 

This could've been an opportunity to refactor this delete to use a POST instead. At some point, I think we'll update the coding guidelines to reflect that, but just a FYI to folk.
Comment 8 Matt Blenkinsop 2023-11-13 14:20:07 UTC
Nice work everyone!

Pushed to oldstable for 22.11.x