Bugzilla – Attachment 163364 Details for
Bug 36351
CSRF Adjustments for Cataloguing editor
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36351: Add CSRF tokens to advanced cataloguing editor POST requests
Bug-36351-Add-CSRF-tokens-to-advanced-cataloguing-.patch (text/plain), 2.36 KB, created by
Nick Clemens (kidclamp)
on 2024-03-18 17:40:25 UTC
(
hide
)
Description:
Bug 36351: Add CSRF tokens to advanced cataloguing editor POST requests
Filename:
MIME Type:
Creator:
Nick Clemens (kidclamp)
Created:
2024-03-18 17:40:25 UTC
Size:
2.36 KB
patch
obsolete
>From e5af79fd5c0007b63fd7e801aab3a66bfb3399b8 Mon Sep 17 00:00:00 2001 >From: Nick Clemens <nick@bywatersolutions.com> >Date: Mon, 18 Mar 2024 17:37:58 +0000 >Subject: [PATCH] Bug 36351: Add CSRF tokens to advanced cataloguing editor > POST requests > >The editor uses ajax post requests to SVC api. >Becuase these apis are XML based requests, they must be handled in the simplest way, by >embedding the token as a header > >To test: >1 - Browse to Cataloguing->Advanced editor >2 - Fill out needed values and save >3 - 403 error >4 - Apply patch >5 - Reload and try agian, success! >6 - Edit and save again, success! >--- > .../intranet-tmpl/lib/koha/cateditor/koha-backend.js | 8 ++++++++ > 1 file changed, 8 insertions(+) > >diff --git a/koha-tmpl/intranet-tmpl/lib/koha/cateditor/koha-backend.js b/koha-tmpl/intranet-tmpl/lib/koha/cateditor/koha-backend.js >index 5410f775633..f5631b5c742 100644 >--- a/koha-tmpl/intranet-tmpl/lib/koha/cateditor/koha-backend.js >+++ b/koha-tmpl/intranet-tmpl/lib/koha/cateditor/koha-backend.js >@@ -136,10 +136,14 @@ define( [ '/cgi-bin/koha/svc/cataloguing/framework?frameworkcode=&callback=defin > record = record.clone(); > _removeBiblionumberFields( record ); > >+ let csrf_token = $('meta[name="csrf-token"]').attr('content'); > $.ajax( { > type: 'POST', > url: '/cgi-bin/koha/svc/new_bib?frameworkcode=' + encodeURIComponent(frameworkcode), > data: record.toXML(), >+ headers: { >+ 'CSRF-TOKEN':csrf_token >+ }, > contentType: 'text/xml' > } ).done( function( data ) { > var record = _fromXMLStruct( data ); >@@ -157,10 +161,14 @@ define( [ '/cgi-bin/koha/svc/cataloguing/framework?frameworkcode=&callback=defin > record = record.clone(); > _removeBiblionumberFields( record ); > >+ let csrf_token = $('meta[name="csrf-token"]').attr('content'); > $.ajax( { > type: 'POST', > url: '/cgi-bin/koha/svc/bib/' + id + '?frameworkcode=' + encodeURIComponent(frameworkcode), > data: record.toXML(), >+ headers: { >+ 'CSRF-TOKEN':csrf_token >+ }, > contentType: 'text/xml' > } ).done( function( data ) { > var record = _fromXMLStruct( data ); >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36351
:
163362
|
163364
|
163387
|
163388
|
163457
|
163458
|
163459
|
163489
|
163490
|
163491
|
163492