Bug 36630 - Item search batch operations buttons broken by CSRF
Summary: Item search batch operations buttons broken by CSRF
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Cataloging (show other bugs)
Version: Main
Hardware: All All
: P5 - low major
Assignee: Brendan Lawlor
QA Contact: Testopia
URL:
Keywords:
Depends on: 34478
Blocks: 36192 38413
  Show dependency tree / graph
 
Reported: 2024-04-17 20:40 UTC by Brendan Lawlor
Modified: 2024-11-09 00:36 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00
Circulation function:

Attachments
Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons (1.90 KB, patch)
2024-04-17 20:58 UTC, Brendan Lawlor 		Details | Diff | Splinter Review
Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons (1.94 KB, patch)
2024-04-18 02:26 UTC, David Nind 		Details | Diff | Splinter Review
Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons (2.02 KB, patch)
2024-04-18 06:47 UTC, Jonathan Druart 		Details | Diff | Splinter Review
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Brendan Lawlor 2024-04-17 20:40:29 UTC 
Since Bug 34478 Full CSRF protection some POST requests return 403 with an error and need to be ajusted.

On the Item search results page, the Batch operations buttons are broken and need to be changed to GET.


To recreate:

1. Do an item search
2. On the results page 'click Select visible rows'
3. Click 'Batch operations' and select 'Batch item modification'
4. See Programming error - op 'show' must start with 'cud-' for POST http://localhost:8081/intranet/tools/batchMod.pl (referer: http://localhost:8081/cgi-bin/koha/catalogue/itemsearch.pl)
5. Click 'Batch operations' and select 'Batch item deletion'
6. See the same error
Comment 1 Brendan Lawlor 2024-04-17 20:58:35 UTC Comment hidden (obsolete)
Comment 2 David Nind 2024-04-18 02:26:46 UTC 
Created attachment 165035 [details] [review]
Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons

This patch changes the form that submits to batchMod.pl from the Item search results page. The form method does not need to be a POST.

    To recreate:

    1. Do an item search
    2. On the results page 'click Select visible rows'
    3. Click 'Batch operations' and select 'Batch item modification'
    4. See Programming error - op 'show' must start with 'cud-' for POST http://localhost:8081/intranet/tools/batchMod.pl (referer: http://localhost:8081/cgi-bin/koha/catalogue/itemsearch.pl)
    5. Click 'Batch operations' and select 'Batch item deletion'
    6. See the same error

    To test:
    1. Apply patch and repeat steps to recreate the issue
    2. See that the batchMod.pl page loads with no error.

Signed-off-by: David Nind <david@davidnind.com>
Comment 3 Jonathan Druart 2024-04-18 06:47:49 UTC 
Created attachment 165036 [details] [review]
Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons

This patch changes the form that submits to batchMod.pl from the Item search results page. The form method does not need to be a POST.

    To recreate:

    1. Do an item search
    2. On the results page 'click Select visible rows'
    3. Click 'Batch operations' and select 'Batch item modification'
    4. See Programming error - op 'show' must start with 'cud-' for POST http://localhost:8081/intranet/tools/batchMod.pl (referer: http://localhost:8081/cgi-bin/koha/catalogue/itemsearch.pl)
    5. Click 'Batch operations' and select 'Batch item deletion'
    6. See the same error

    To test:
    1. Apply patch and repeat steps to recreate the issue
    2. See that the batchMod.pl page loads with no error.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 4 Katrin Fischer 2024-04-18 14:52:23 UTC 
Pushed for 24.05!

Well done everyone, thank you!
Comment 5 Fridolin Somers 2024-05-22 12:21:56 UTC 
Depends on Bug 34478 not in 23.11.x