Attachment 171537 Details for Bug 37767 – Bug 37767: Fix forms that POST without an op in Authority types

[patch] Bug 37767: Fix forms that POST without an op in Authority types

Bug-37767-Fix-forms-that-POST-without-an-op-in-Aut.patch (text/plain), 3.49 KB, created by Jonathan Druart on 2024-09-16 11:54:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2024-09-16 11:54:36 UTC

Size: 3.49 KB

patch

obsolete

>From 27891211b4f0eb761c0cb8a868310f2d2e3fef28 Mon Sep 17 00:00:00 2001
>From: Phil Ringnalda <phil@chetcolibrary.org>
>Date: Thu, 29 Aug 2024 17:34:36 -0700
>Subject: [PATCH] Bug 37767: Fix forms that POST without an op in Authority
> types
>
>We intend not to have forms with method="post" without an op variable (so we
>can check that the op starts with "cud-" as part of the CSRF protection), but
>because of bug 37728 some were missed.
>
>In Authority types, that's dead code in the template that expects to show a
>"Data deleted" confirmation page, but it never shows because rather than
>setting the variable delete_confirmed and outputting the template, the op
>cud-delete_confirmed just does a print $input->redirect() and exits, and, the
>search for tags form that should be a GET so it can be bookmarked and linked
>to.
>
>Test plan:
> 1. Without the patch, Administration - Authority types - choose one other
>    than default, so you can see the code rather than "" in the URL -
>    Actions - MARC structure
> 2. For any tag (you *are* testing in a throwaway database, right?) click
>    Actions - Delete then Yes, delete
> 3. Note that you don't get a confirmation page, just redirected back to a
>    search for your tag which no longer exists, with the searchfield and
>    authtypecode nicely in the URL
> 4. Click the Search button for the Search for tag form, without changing
>    anything
> 5. Note that your URL lost the searchfield and authtypecode
> 6. Apply patch, restart_all
> 7. Repeat steps 1, 2, and 3, with identical results like they should be
> 8. Repeat step 4, but this time note that the searchfield and authtypecode
>    stay in the URL.
> 9. Change the select menu for In framework and click Search, note that
>    the searchfield and frameworkcode are still in the URL and still correct
>    and that the correct results show
>10. Change the tag number and hit Enter, and verify that the URL and the
>    page show the correct results
>
>Sponsored-by: Chetco Community Public Library
>Signed-off-by: Sukhmandeep Benipal <sukhmandeep.benipal@inLibro.com>
>
>Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>---
> .../prog/en/modules/admin/auth_tag_structure.tt     | 13 +------------
> 1 file changed, 1 insertion(+), 12 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt
>index fa0974bc4f5..7f6500c9380 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt
>@@ -200,16 +200,6 @@
>     </div>
> [% END %]
> 
>-[% IF ( delete_confirmed ) %]
>-
>-  <div class="alert alert-info">  <h3>Data deleted</h3>
>-    <form action="[% script_name | html %]" method="post">
>-        [% INCLUDE 'csrf-token.inc' %]
>-    <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
>-    <input type="hidden" name="searchfield" value="[% searchfield | html %]" />
>-    <input type="submit" value="OK" class="btn btn-primary" />
>-    </form></div>
>-[% END %]
> [% IF ( authtype_create ) %]
> 
>     <form action="[% script_name | html %]" method="post">
>@@ -233,8 +223,7 @@
> 
> [% IF ( else ) %]
> 
>-<form action="[% script_name | html %]" method="post">
>-    [% INCLUDE 'csrf-token.inc' %]
>+<form action="[% script_name | html %]" method="get">
>     <fieldset>
>         <label for="searchfield"><strong>Search for tag:</strong></label>
>         <input type="text" id="searchfield" name="searchfield" size="4" value="[% searchfield | html %]" />
>-- 
>2.34.1

Actions: View | Diff | Splinter Review

Attachments on bug 37767: 170894 | 171216 | 171537