Bug 36597 - Cannot delete circulation desk
Summary: Cannot delete circulation desk
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: System Administration (show other bugs)
Version: Main
Hardware: All All
: P5 - low major
Assignee: Owen Leonard
QA Contact: Martin Renvoize (ashimema)
URL:
Keywords:
Depends on: 36192
Blocks:
  Show dependency treegraph
 
Reported: 2024-04-12 12:30 UTC by Owen Leonard
Modified: 2024-12-23 08:06 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00
Circulation function:


Attachments
Bug 36597: Fix deletion of circulation desks broken by CSRF (1.27 KB, patch)
2024-04-12 12:33 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 36597: Fix deletion of circulation desks broken by CSRF (1.33 KB, patch)
2024-04-12 12:43 UTC, Brendan Lawlor
Details | Diff | Splinter Review
Bug 36597: Fix deletion of circulation desks broken by CSRF (1.39 KB, patch)
2024-04-17 09:55 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Owen Leonard 2024-04-12 12:30:44 UTC
Our CSRF work introduced a problem with deleting circulation desks: The "delete_confirm" does not need "cud-" because it's a GET operation leading to a POSTed deletion after the confirmation is submitted.
Comment 1 Owen Leonard 2024-04-12 12:33:45 UTC
Created attachment 164844 [details] [review]
Bug 36597: Fix deletion of circulation desks broken by CSRF

Our CSRF work introduced a problem with deleting circulation desks: The
"delete_confirm" does not need "cud-" because it's a GET operation
leading to a POSTed deletion after the confirmation is submitted.

To test, apply the patch and restart services.

- Go to Administration -> Circulation desks.
- If necessary, create a circulation desk.
- Click the "Delete" button for you new desk.
- You should be taken to a confirmation page which shows details of the
  desk you're deleting.
- Confirming the deletion should result in deletion of the desk.
Comment 2 Brendan Lawlor 2024-04-12 12:43:50 UTC
Created attachment 164845 [details] [review]
Bug 36597: Fix deletion of circulation desks broken by CSRF

Our CSRF work introduced a problem with deleting circulation desks: The
"delete_confirm" does not need "cud-" because it's a GET operation
leading to a POSTed deletion after the confirmation is submitted.

To test, apply the patch and restart services.

- Go to Administration -> Circulation desks.
- If necessary, create a circulation desk.
- Click the "Delete" button for you new desk.
- You should be taken to a confirmation page which shows details of the
  desk you're deleting.
- Confirming the deletion should result in deletion of the desk.

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Comment 3 Martin Renvoize (ashimema) 2024-04-17 09:55:51 UTC
Created attachment 164988 [details] [review]
Bug 36597: Fix deletion of circulation desks broken by CSRF

Our CSRF work introduced a problem with deleting circulation desks: The
"delete_confirm" does not need "cud-" because it's a GET operation
leading to a POSTed deletion after the confirmation is submitted.

To test, apply the patch and restart services.

- Go to Administration -> Circulation desks.
- If necessary, create a circulation desk.
- Click the "Delete" button for you new desk.
- You should be taken to a confirmation page which shows details of the
  desk you're deleting.
- Confirming the deletion should result in deletion of the desk.

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 4 Martin Renvoize (ashimema) 2024-04-17 09:56:09 UTC
Trivial fix, thanks Owen.

Passing QA
Comment 5 Katrin Fischer 2024-04-18 14:52:16 UTC
Pushed for 24.05!

Well done everyone, thank you!
Comment 6 Fridolin Somers 2024-05-22 12:21:29 UTC
23.11.x not impacted