Bugzilla – Attachment 174759 Details for
Bug 38463
Unnecessary CSRF token in OPAC authority search
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38463: Unnecessary CSRF token in OPAC authority search
Bug-38463-Unnecessary-CSRF-token-in-OPAC-authority.patch (text/plain), 2.39 KB, created by
Emily Lamancusa (emlam)
on 2024-11-18 20:45:58 UTC
(
hide
)
Description:
Bug 38463: Unnecessary CSRF token in OPAC authority search
Filename:
MIME Type:
Creator:
Emily Lamancusa (emlam)
Created:
2024-11-18 20:45:58 UTC
Size:
2.39 KB
patch
obsolete
>From 6071a16031c967c8ae987ecb3e5b3b4ca452d9d3 Mon Sep 17 00:00:00 2001 >From: Phil Ringnalda <phil@chetcolibrary.org> >Date: Fri, 15 Nov 2024 14:13:11 -0800 >Subject: [PATCH] Bug 38463: Unnecessary CSRF token in OPAC authority search > >Bug 37069 correctly changed OPAC authority searches from a POST to a GET, but >forgot to remove the CSRF token that is only needed for a POST, so now it >clutters up the URL by making the first 107 characters of the query string >meaningless. > >Test plan: > 1. Without the patch, in the OPAC, go to Authority search > 2. Change the dropdowns to non-default values so you have meaningful search > conditions, and search for something that will return results, like > Topical Term/starts with/a/in any heading/Heading descendant > 3. Copy the URL of your search results, paste it in an email compose window, > look at what you just pasted and wonder whether that big opaque string is > actually safe to send to a coworker. Go to lunch. Come back and wonder > what you searched for, and look at the URL in the browser to try to tell > 4. Apply patch, click the browser back button, reload the page, search again > 5. Copy and paste the URL, notice it looks fine to send, just a search. Look > at the URL in the browser address bar, notice that within the limits of > your window size, you can see what you searched for > >Sponsored-by: Chetco Community Public Library >Signed-off-by: David Nind <david@davidnind.com> >Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> >--- > .../opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt | 1 - > 1 file changed, 1 deletion(-) > >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt >index e3f3204695..59c07f22b3 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt >@@ -38,7 +38,6 @@ > [% END %] > <div id="userauthhome" class="maincontent"> > <form name="f" action="/cgi-bin/koha/opac-authorities-home.pl" method="get"> >- [% INCLUDE 'csrf-token.inc' %] > <input type="hidden" name="op" value="do_search" /> > <input type="hidden" name="type" value="opac" /> > <fieldset class="rows"> >-- >2.34.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38463
:
174635
|
174637
| 174759