Bug 37523 - CSRF error when modifying an existing patron record
Summary: CSRF error when modifying an existing patron record
Status: Needs documenting
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: Main
Hardware: All All
: P1 - high major
Assignee: Owen Leonard
QA Contact: Emily Lamancusa (emlam)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-07-30 11:43 UTC by Johanna Räisä
Modified: 2024-09-16 14:07 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.11.00,24.05.04
Circulation function:


Attachments
Bug 37523: CSRF error when modifying an existing patron record (3.21 KB, patch)
2024-07-30 12:27 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 37523: CSRF error when modifying an existing patron record (3.26 KB, patch)
2024-07-30 14:37 UTC, Roman Dolny
Details | Diff | Splinter Review
Bug 37523: CSRF error when modifying an existing patron record (3.41 KB, patch)
2024-07-31 05:44 UTC, Johanna Räisä
Details | Diff | Splinter Review
Bug 37523: CSRF error when modifying an existing patron record (3.48 KB, patch)
2024-07-31 20:49 UTC, Emily Lamancusa (emlam)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Johanna Räisä 2024-07-30 11:43:11 UTC
When Koha finds a duplicate patron and you are trying to modify it, Koha will throw an error:

Programming error - op 'edit_form' must start with 'cud-' for POST http://127.0.0.1:8081/intranet/members/memberentry.pl (referer: http://127.0.0.1:8081/cgi-bin/koha/members/memberentry.pl)
Comment 1 Owen Leonard 2024-07-30 12:27:39 UTC
Created attachment 169857 [details] [review]
Bug 37523: CSRF error when modifying an existing patron record

This patch modifies the patron entry template to avoid a CSRF error when
clicking the "Edit existing record" button after a duplicate patron is
found. The operation should be GET and thus can be a link.

To test, apply the patch and go to Patrons.

- If you aren't using the default testing data you should first locate
  an existing patron record so you can refer to the details.
- Start the process of creating a new patron record.
- Use the existing patron's data to fill out the form.
  - With the default data you can use:
    - Surname: Bennett
    - First name: Pamela
    - Date of birth: 09/16/1946
    - Any random new card number
- When you click "Save" you should get a duplicate patron warning:
  "Duplicate patron record?"
  - Click "It is a duplicate. Edit existing record."
  - You should be taken to the edit form for the existing patron.

Sponsored-by: Athens County Public Libraries
Comment 2 Roman Dolny 2024-07-30 14:37:55 UTC
Created attachment 169867 [details] [review]
Bug 37523: CSRF error when modifying an existing patron record

This patch modifies the patron entry template to avoid a CSRF error when
clicking the "Edit existing record" button after a duplicate patron is
found. The operation should be GET and thus can be a link.

To test, apply the patch and go to Patrons.

- If you aren't using the default testing data you should first locate
  an existing patron record so you can refer to the details.
- Start the process of creating a new patron record.
- Use the existing patron's data to fill out the form.
  - With the default data you can use:
    - Surname: Bennett
    - First name: Pamela
    - Date of birth: 09/16/1946
    - Any random new card number
- When you click "Save" you should get a duplicate patron warning:
  "Duplicate patron record?"
  - Click "It is a duplicate. Edit existing record."
  - You should be taken to the edit form for the existing patron.

Sponsored-by: Athens County Public Libraries
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Comment 3 Johanna Räisä 2024-07-31 05:44:23 UTC
Created attachment 169880 [details] [review]
Bug 37523: CSRF error when modifying an existing patron record

This patch modifies the patron entry template to avoid a CSRF error when
clicking the "Edit existing record" button after a duplicate patron is
found. The operation should be GET and thus can be a link.

To test, apply the patch and go to Patrons.

- If you aren't using the default testing data you should first locate
  an existing patron record so you can refer to the details.
- Start the process of creating a new patron record.
- Use the existing patron's data to fill out the form.
  - With the default data you can use:
    - Surname: Bennett
    - First name: Pamela
    - Date of birth: 09/16/1946
    - Any random new card number
- When you click "Save" you should get a duplicate patron warning:
  "Duplicate patron record?"
  - Click "It is a duplicate. Edit existing record."
  - You should be taken to the edit form for the existing patron.

Sponsored-by: Athens County Public Libraries
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Johanna Räisä <johanna.raisa@gmail.com>
Comment 4 Emily Lamancusa (emlam) 2024-07-31 20:49:19 UTC
Created attachment 169916 [details] [review]
Bug 37523: CSRF error when modifying an existing patron record

This patch modifies the patron entry template to avoid a CSRF error when
clicking the "Edit existing record" button after a duplicate patron is
found. The operation should be GET and thus can be a link.

To test, apply the patch and go to Patrons.

- If you aren't using the default testing data you should first locate
  an existing patron record so you can refer to the details.
- Start the process of creating a new patron record.
- Use the existing patron's data to fill out the form.
  - With the default data you can use:
    - Surname: Bennett
    - First name: Pamela
    - Date of birth: 09/16/1946
    - Any random new card number
- When you click "Save" you should get a duplicate patron warning:
  "Duplicate patron record?"
  - Click "It is a duplicate. Edit existing record."
  - You should be taken to the edit form for the existing patron.

Sponsored-by: Athens County Public Libraries
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Johanna Räisä <johanna.raisa@gmail.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Comment 5 Emily Lamancusa (emlam) 2024-07-31 20:59:49 UTC
This works and QA tool passes. This really doesn't need to be a form submission; the direct link works fine, so the new coding guideline (JS16) doesn't apply here. Passing QA.
Comment 6 Katrin Fischer 2024-08-01 16:27:37 UTC
Pushed for 24.11!

Well done everyone, thank you!
Comment 7 Lucas Gass (lukeg) 2024-08-29 17:13:48 UTC
Backported to 24.05.x for upcoming 24.05.04
Comment 8 Fridolin Somers 2024-09-16 14:07:33 UTC
Not for 23.11.x