Bugzilla – Attachment 180348 Details for
Bug 39527
Cannot create a new notice when running Koha as a Mojolicious application
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 39527: Add action attribute to letter.pl form
Bug-39527-Add-action-attribute-to-letterpl-form.patch (text/plain), 1.86 KB, created by
Julian Maurice
on 2025-04-02 13:22:03 UTC
(
hide
)
Description:
Bug 39527: Add action attribute to letter.pl form
Filename:
MIME Type:
Creator:
Julian Maurice
Created:
2025-04-02 13:22:03 UTC
Size:
1.86 KB
patch
obsolete
>From fc71d34c28fc6e19f563cd5e388cfde520cbd38b Mon Sep 17 00:00:00 2001 >From: Julian Maurice <julian.maurice@biblibre.com> >Date: Wed, 2 Apr 2025 15:06:35 +0200 >Subject: [PATCH] Bug 39527: Add action attribute to letter.pl form >MIME-Version: 1.0 >Content-Type: text/plain; charset=UTF-8 >Content-Transfer-Encoding: 8bit > >If not explicitly set, two 'op' parameters are sent, one with the value >in the URL (add_form), one with the value in the form >(cud-add_validate). >This causes an error in the CSRF validation code under Mojolicious >environment. > >Test plan: >1. Start staff interface as mojolicious application: > `bin/intranet daemon -l http://*:3000/` >2. Go to http://localhost:3000 (replace localhost by the hostname where > koha is running), log in, then go to Tools » Notices and slips. >3. Create a new notice. > Without the patch it fails with the following message: > Incorrect use of an unsafe HTTP method with an `op` parameter that > does not start with "cud-" > With the patch it should succeed. >--- > koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt >index 2bc37a1264..9d5b4495aa 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt >@@ -366,7 +366,7 @@ > </div> > <!-- /#toolbar --> > >- <form id="add_notice" name="Aform" method="post" enctype="multipart/form-data" class="validate"> >+ <form id="add_notice" name="Aform" method="post" enctype="multipart/form-data" class="validate" action="/cgi-bin/koha/tools/letter.pl"> > [% INCLUDE 'csrf-token.inc' %] > [% IF add_form %] > <input type="hidden" name="op" id="op" value="cud-add_validate" /> >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 39527
: 180348