Bugzilla – Attachment 166726 Details for
Bug 36414
Consequent workflow stages form submit fail due to CSRF token conflict
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36414: OPAC - Skip csrf_token
Bug-36414-OPAC---Skip-csrftoken.patch (text/plain), 3.19 KB, created by
Nick Clemens (kidclamp)
on 2024-05-14 18:33:28 UTC
(
hide
)
Description:
Bug 36414: OPAC - Skip csrf_token
Filename:
MIME Type:
Creator:
Nick Clemens (kidclamp)
Created:
2024-05-14 18:33:28 UTC
Size:
3.19 KB
patch
obsolete
>From 1b52d2b6f977c513ceeb6d8ebe5d5031d64846fe Mon Sep 17 00:00:00 2001 >From: Pedro Amorim <pedro.amorim@ptfs-europe.com> >Date: Mon, 25 Mar 2024 10:26:10 +0000 >Subject: [PATCH] Bug 36414: OPAC - Skip csrf_token > >Skip csrf_token field if it already exists and >is coming from a previous workflow stage form >submission, as it's already included at the >start of the form. > >The test plan requires EDS credentials in order to be followed. >I'm available to help others through this test plan if required. >Otherwise, I believe the code is simple enough to understand >and follow what it's fixing without testing. > >Test plan: >1) Install an ILL availabililty plugin, e.g.: >https://github.com/PTFS-Europe/koha-plugin-ill-avail-eds >3) Configure the plugin and add EDS credentials >4) Enable ILLCheckAvailability sys pref >5) Enable ILLModuleDisclaimerByType by copying the example YAML block in the sys pref description >6) Create a new ILL request of type 'Book' and add a DOI >7) You should now be on the availabililty stage, click 'Continue adding your request' >8) You should now be on the type disclaimer stage, click 'Create' >9) Notice 'Wrong CSRF token' error. >This happens because the type disclaimer stage is adding its own CSRF token in addition >to the CSRF token coming from the previous availabililty stage >10) Apply patch. Repeat. No error -> Request is created as expected. >11) Do the same test plan on both Staff UI and OPAC > >Signed-off-by: Nick Clemens <nick@bywatersolutions.com> >--- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt >index 8adb5229df0..975c2a078e2 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt >@@ -262,7 +262,7 @@ > <legend><h2>Displaying availability results</h2></legend> > [% FOREACH key IN whole.keys %] > [% value = whole.$key %] >- [% IF key != 'custom_key' && key != 'custom_value' %] >+ [% IF key != 'custom_key' && key != 'custom_value' && key != 'csrf_token' %] > <input type="hidden" name="[% key | html %]" value="[% value | html %]"> > [% END %] > [% END %] >@@ -307,7 +307,7 @@ > <fieldset class="action"> > [% FOREACH key IN whole.keys %] > [% value = whole.$key %] >- [% IF key != 'custom_key' && key != 'custom_value' %] >+ [% IF key != 'custom_key' && key != 'custom_value' && key != 'csrf_token' %] > <input type="hidden" name="[% key | html %]" value="[% value | html %]"> > [% END %] > [% END %] >-- >2.39.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36414
:
163785
|
163786
|
166725
| 166726