Bug 37074 - Comment approval and un-approval should be CSRF-protected
Summary: Comment approval and un-approval should be CSRF-protected
Status: Pushed to stable
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal
Assignee: Owen Leonard
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 2486
  Show dependency treegraph
 
Reported: 2024-06-12 12:32 UTC by Owen Leonard
Modified: 2024-08-01 15:35 UTC (History)
13 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.11.00,24.05.02
Circulation function:


Attachments
Bug 37074: Comment approval and un-approval should be CSRF-protected (4.04 KB, patch)
2024-06-12 18:25 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 37074: Comment approval and un-approval should be CSRF-protected (4.10 KB, patch)
2024-06-13 21:51 UTC, Lucas Gass
Details | Diff | Splinter Review
Bug 37074: Comment approval and un-approval should be CSRF-protected (4.17 KB, patch)
2024-06-14 07:27 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 37074: Do no pass biblionumber (2.50 KB, patch)
2024-06-14 07:27 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Owen Leonard 2024-06-12 12:32:46 UTC
In Tools -> Comments, the process of approving and un-approving comments is a GET operation. These should be POST'ed with a CSRF token.
Comment 1 Owen Leonard 2024-06-12 18:25:30 UTC
Created attachment 167671 [details] [review]
Bug 37074: Comment approval and un-approval should be CSRF-protected

This patch converts the "Approve" and "Unapprove" controls in the staff
client's comment moderation page so that the operations are POST instead
of GET.

To test, apply the patch and restart services.

- If necessary, enable OPACComments and submit a few comments on a few
  titles in the OPAC
- Go to Tools -> Comments
- Test the process of approving, unapproving, and deleting comments
Comment 2 Lucas Gass 2024-06-13 21:51:04 UTC
Created attachment 167702 [details] [review]
Bug 37074: Comment approval and un-approval should be CSRF-protected

This patch converts the "Approve" and "Unapprove" controls in the staff
client's comment moderation page so that the operations are POST instead
of GET.

To test, apply the patch and restart services.

- If necessary, enable OPACComments and submit a few comments on a few
  titles in the OPAC
- Go to Tools -> Comments
- Test the process of approving, unapproving, and deleting comments

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Comment 3 Jonathan Druart 2024-06-14 07:27:40 UTC
Created attachment 167707 [details] [review]
Bug 37074: Comment approval and un-approval should be CSRF-protected

This patch converts the "Approve" and "Unapprove" controls in the staff
client's comment moderation page so that the operations are POST instead
of GET.

To test, apply the patch and restart services.

- If necessary, enable OPACComments and submit a few comments on a few
  titles in the OPAC
- Go to Tools -> Comments
- Test the process of approving, unapproving, and deleting comments

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 4 Jonathan Druart 2024-06-14 07:27:43 UTC
Created attachment 167708 [details] [review]
Bug 37074: Do no pass biblionumber

It is not used in the controller

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 5 wainuiwitikapark 2024-07-18 04:41:21 UTC
Patch doesn't apply cleanly for 23.05.x, could this please be rebased?
Comment 6 Katrin Fischer 2024-07-18 10:53:20 UTC
Hi Wainui, this used cud- from the big CSRF bug, so it doesn't apply beyond 24.05.
Comment 7 wainuiwitikapark 2024-07-18 23:08:15 UTC
(In reply to Katrin Fischer from comment #6)
> Hi Wainui, this used cud- from the big CSRF bug, so it doesn't apply beyond
> 24.05.

Ok, thanks!
Comment 8 Lucas Gass 2024-07-25 15:20:07 UTC
This has been backported to 24.05.x-security branch for 24.05.02
Comment 9 Katrin Fischer 2024-08-01 15:33:56 UTC
Pushed for 24.11!

Well done everyone, thank you!