Bug 18740

Summary: [16.05.12-16.05.13] Cannot modify patron password
Product: Koha Reporter: Jonathan Druart <jonathan.druart>
Component: PatronsAssignee: Jonathan Druart <jonathan.druart>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: gmcharlt, kyle.m.hall, mtj
Version: 16.05   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 16992    
Bug Blocks:    
Attachments: Bug 18740: (bug 16992 follow-up) Add CSRF token to the template
Bug 18740: (bug 16992 follow-up) Add CSRF token to the template
work-around without patch

Description Jonathan Druart 2017-06-06 19:40:13 UTC

    
Comment 1 Jonathan Druart 2017-06-06 19:44:03 UTC
Created attachment 64067 [details] [review]
Bug 18740: (bug 16992 follow-up) Add CSRF token to the template

Bug 16992 is in
  commit 9e74db7b51085f62919e34ab4e5ccdf9da2066a1
    Bug 18124: Restrict CSRF token to user's session

but template change is missing

Test plan:
Modify a patron from member-password.pl
Without this patch you got
  Wrong CSRF token at /home/vagrant/kohaclone/members/member-password.pl line 68.
Comment 2 Tomás Cohen Arazi 2017-06-06 19:56:11 UTC
Created attachment 64068 [details] [review]
Bug 18740: (bug 16992 follow-up) Add CSRF token to the template

Bug 16992 is in
  commit 9e74db7b51085f62919e34ab4e5ccdf9da2066a1
    Bug 18124: Restrict CSRF token to user's session

but template change is missing

Test plan:
Modify a patron from member-password.pl
Without this patch you got
  Wrong CSRF token at /home/vagrant/kohaclone/members/member-password.pl line 68.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Patch fixes the bug. Passes the qa script.
Comment 3 Mason James 2017-06-13 06:04:15 UTC
(In reply to Tomás Cohen Arazi from comment #2)
> Created attachment 64068 [details] [review] [review]
> Bug 18740: (bug 16992 follow-up) Add CSRF token to the template
> 
> Bug 16992 is in
>   commit 9e74db7b51085f62919e34ab4e5ccdf9da2066a1
>     Bug 18124: Restrict CSRF token to user's session
> 
> but template change is missing
> 
> Test plan:
> Modify a patron from member-password.pl
> Without this patch you got
>   Wrong CSRF token at /home/vagrant/kohaclone/members/member-password.pl
> line 68.
> 
> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
> Patch fixes the bug. Passes the qa script.

I've tested this as working OK, so I'll include this patch in an early release

Thanks Joubu and Tomás for sorting this bug :0)
Comment 4 Mason James 2017-06-13 06:04:35 UTC
Pushed to 16.05.x, for 16.05.14 release
Comment 5 Mason James 2017-06-13 08:54:57 UTC
Created attachment 64254 [details]
work-around without patch
Comment 6 Mason James 2017-06-13 08:56:12 UTC
(In reply to Mason James from comment #5)
> Created attachment 64254 [details]
> work-around without patch

i did find a work-around for this bug, without the patch

it's possible to change a password using the members/memberentry.pl page