Bug 18975

Summary: Wrong CSRF token when emailing cart contents
Product: Koha Reporter: Barry Cannon <bc>
Component: OPACAssignee: Jonathan Druart <jonathan.druart>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: jonathan.druart, jzairo, katrin.fischer, liz, marjorie.barry-vila, nick, patrick.robitaille
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 18975: Retrieve up-to-date CGISESSID when just logged in
Bug 18975: Retrieve up-to-date CGISESSID when just logged in
Bug 18975: Retrieve up-to-date CGISESSID when just logged in

Description Barry Cannon 2017-07-24 13:15:48 UTC
When you are not logged into the OPAC and attempt to email the contents of your cart you get the following error : "Wrong CSRF token at /usr/share/koha/opac/cgi-bin/opac/opac-sendbasket.pl line 55"

Some testing shows:

If you log in before adding items to your cart then send it, it works. If you're not logged in and you log in as part of sending the basket, the error occurs

It must be that authenticating in that window doesn't set the session and id / secret aren't being set before submitting
If you aren't logged in, click send the basket and log in, refresh the page before sending, then send, it forces it to pick up the session and works
Comment 1 Liz Rea 2017-11-05 22:10:22 UTC
I confirm this bug in 16.11.05.
Comment 2 Jonathan Druart 2017-12-21 19:18:21 UTC
It affects master as well
Comment 3 Jonathan Druart 2017-12-21 20:17:40 UTC
Created attachment 70084 [details] [review]
Bug 18975: Retrieve up-to-date CGISESSID when just logged in

If a user is asked to login before sending a card, the wrong (old)
CGISESSID cookie is used.
We need to retrieve the one that has just been created.

This will certainly need more work, I guess other scripts are affected
too.
Comment 4 Katrin Fischer 2018-02-11 16:14:35 UTC
Should this be NSO?
Comment 5 Jonathan Druart 2018-02-12 14:02:55 UTC
I do not have time to investigate more the other scripts, but this one patch can be tested yes.
Comment 6 Claire Gravely 2018-02-12 15:04:51 UTC
Created attachment 71480 [details] [review]
Bug 18975: Retrieve up-to-date CGISESSID when just logged in

If a user is asked to login before sending a card, the wrong (old)
CGISESSID cookie is used.
We need to retrieve the one that has just been created.

This will certainly need more work, I guess other scripts are affected
too.

Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>
Comment 7 Nick Clemens (kidclamp) 2018-02-17 15:05:32 UTC
Created attachment 71883 [details] [review]
Bug 18975: Retrieve up-to-date CGISESSID when just logged in

If a user is asked to login before sending a card, the wrong (old)
CGISESSID cookie is used.
We need to retrieve the one that has just been created.

This will certainly need more work, I guess other scripts are affected
too.

Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>
Comment 8 Jonathan Druart 2018-02-18 19:49:35 UTC
Pushed to master for 18.05, thanks to everybody involved!
Comment 9 Nick Clemens (kidclamp) 2018-02-26 11:39:53 UTC
Awesome work all! Pushed to stable for 17.11.03