Bug 31492

Summary: Patron image upload fails on first attempt with CSRF failure
Product: Koha Reporter: Matthew LS <matthew.lindfield-seager>
Component: PatronsAssignee: Lucas Gass (lukeg) <lucas>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: arthur.suzuki, bugzilla, david, gmcharlt, jrobb, kyle.m.hall, lucas, madamyk, nick, wainuiwitikapark, wsmith
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.05.00,22.11.02,22.05.09, 21.11.16
Circulation function:
Bug Depends on: 20809    
Bug Blocks:    
Attachments: Bug 31492: Set CSRF token in circulation.pl
Bug 31492: Set CSRF token in circulation.pl
Bug 31492: Set CSRF token in circulation.pl

Description Matthew LS 2022-08-31 03:33:33 UTC
After upgrading to 22.05.004 (and after manually installing `libmojolicious-plugin-openapi-perl` to get patron search to work - as per https://www.mail-archive.com/koha@lists.katipo.co.nz/msg28885.html) we are now seeing an issue uploading patron images.

After logging in to Koha, the first attempt to upload an individual patron image (from the patron show screen) fails with a CSRF error:

> The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.

Second and subsequent attempts succeed up until we log out and log back in again. After that the first submission once again fails.

I tailed the logs to see if I could see any errors using `tail -f /var/log/koha/library/*.log`. On one occasion I saw an error related to `picture_upload.pl` in `/var/log/koha/library/intranet-error.log` but I can't reproduce it.

In case it's relevant the error I saw once was:
> [Wed Aug 31 09:55:06.665314 2022] [cgi:error] [pid 288501] [client 136.228.129.94:64313] AH01215: Use of uninitialized value $cardnumber in concatenation (.) or string at /usr/share/koha/intranet/cgi-bin/tools/picture-upload.pl line 66.: /usr/share/koha/intranet/cgi-bin/tools/picture-upload.pl, referer: https://<library url>/cgi-bin/koha/circ/circulation.pl?borrowernumber=1790

The CSRF error in the client is reproducible in up-to-date versions of Chrome on Windows and Safari on macOS so it doesn't seem to be browser or OS specific.
Comment 1 Katrin Fischer 2022-09-11 14:02:37 UTC
I am seeing this issue on the master branch (current development) as well. Updating bug.

To test: 
* Turn on patronimages system preferences
* Go to any patron account
* Hover over the 'dummy image' for the Add button
* Browse and select an image for upload
* Saving results in the following error:

The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.
Comment 2 Jason Robb 2023-01-03 17:46:10 UTC
Not sure if this is the exact same issue but I'm on 22.05.07 and consistently getting the "Wrong CSRF Token" error any time I try to add a patron photo from any page of the account *other than* the Details (moremember.pl) tab.

I've tested with both the snazzy new camera integration and by manually uploading a file, and in both cases, it only succeeds on moremember.pl.
Comment 3 Wes 2023-01-05 01:14:17 UTC
I'm experiencing the same issue as Jason Robb. Works fine on moremember.pl but csrf_token is empty in the html on any of the other patron tab/pages.
Comment 4 Michael Adamyk 2023-01-05 21:13:13 UTC
Confirmed, I'm experiencing this issue after the 22.05 upgrade also.
Comment 5 Nick Clemens (kidclamp) 2023-01-09 12:08:03 UTC Comment hidden (obsolete)
Comment 6 Lucas Gass (lukeg) 2023-01-13 19:03:46 UTC
Created attachment 145303 [details] [review]
Bug 31492: Set CSRF token in circulation.pl

To test:
* Turn on patronimages system preferences
* Go to any patron account
* Hover over the 'dummy image' for the Add button
* Browse and select an image for upload
* Saving results in the following error:

The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.

Apply patch and try again. You shouldn't need to try twice, it should work on the first attempt now.
Comment 7 David Nind 2023-01-17 00:48:17 UTC
Created attachment 145346 [details] [review]
Bug 31492: Set CSRF token in circulation.pl

To test:
* Turn on patronimages system preferences
* Go to any patron account
* Hover over the 'dummy image' for the Add button
* Browse and select an image for upload
* Saving results in the following error:

The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.

Apply patch and try again. You shouldn't need to try twice, it should work on the first attempt now.

Signed-off-by: David Nind <david@davidnind.com>
Comment 8 David Nind 2023-01-17 00:50:20 UTC
Testing notes (using koha-testing-docker):

1. No error when using Firefox (on Kubuntu 22.04). After apply patch, continues to work as expected.

2. Error when using Chromium and Google Chrome. Applying the patch successfully fixes the issue.
Comment 9 David Cook 2023-01-17 04:58:06 UTC
Created attachment 145347 [details] [review]
Bug 31492: Set CSRF token in circulation.pl

To test:
* Turn on patronimages system preferences
* Go to any patron account
* Hover over the 'dummy image' for the Add button
* Browse and select an image for upload
* Saving results in the following error:

The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.

Apply patch and try again. You shouldn't need to try twice, it should work on the first attempt now.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 10 Martin Renvoize (ashimema) 2023-01-18 15:50:01 UTC
Nice work everyone!

Pushed to 23.05.x for the next release
Comment 11 Jacob O'Mara 2023-01-18 17:05:44 UTC
Nice work, thanks everyone!

Pushed to 22.11.x for the next release.
Comment 12 Lucas Gass (lukeg) 2023-01-20 00:02:35 UTC
Backported to 22.05.x for upcoming 22.05.09
Comment 13 Arthur Suzuki 2023-01-26 13:11:47 UTC
applied to 21.11.x for 21.11.16
Comment 14 Wainui Witika-Park 2023-03-15 01:34:17 UTC
Not backported to 21.05.x