| Summary: | Patron image upload fails on first attempt with CSRF failure | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Matthew LS <matthew.lindfield-seager> |
| Component: | Patrons | Assignee: | Lucas Gass (lukeg) <lucas> |
| Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | arthur.suzuki, bugzilla, david, gmcharlt, jrobb, kyle.m.hall, lucas, madamyk, nick, wainuiwitikapark, wsmith |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
23.05.00,22.11.02,22.05.09, 21.11.16
|
|
| Circulation function: | |||
| Bug Depends on: | 20809 | ||
| Bug Blocks: | |||
| Attachments: |
Bug 31492: Set CSRF token in circulation.pl
Bug 31492: Set CSRF token in circulation.pl Bug 31492: Set CSRF token in circulation.pl |
||
|
Description
Matthew LS
2022-08-31 03:33:33 UTC
I am seeing this issue on the master branch (current development) as well. Updating bug. To test: * Turn on patronimages system preferences * Go to any patron account * Hover over the 'dummy image' for the Add button * Browse and select an image for upload * Saving results in the following error: The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again. Not sure if this is the exact same issue but I'm on 22.05.07 and consistently getting the "Wrong CSRF Token" error any time I try to add a patron photo from any page of the account *other than* the Details (moremember.pl) tab. I've tested with both the snazzy new camera integration and by manually uploading a file, and in both cases, it only succeeds on moremember.pl. I'm experiencing the same issue as Jason Robb. Works fine on moremember.pl but csrf_token is empty in the html on any of the other patron tab/pages. Confirmed, I'm experiencing this issue after the 22.05 upgrade also. I suspect the issue is from bug 20809, members-menu.js: + $(".edit-patronimage").on("click", function(e){ + e.preventDefault(); + var borrowernumber = $(this).data("borrowernumber"); + $.get("/cgi-bin/koha/members/moremember.pl", { borrowernumber : borrowernumber }, function( data ){ + var image_form = $(data).find("#picture-upload"); + image_form.show().find(".cancel").remove(); + $("#patronImageEdit .modal-body").html( image_form ); + }); + var modalTitle = $(this).attr("title"); + $("#patronImageEdit .modal-title").text(modalTitle); + $("#patronImageEdit").modal("show"); + }); It looks like we are fetching the form via JS, maybe is causing the CSRF mismatch? Created attachment 145303 [details] [review] Bug 31492: Set CSRF token in circulation.pl To test: * Turn on patronimages system preferences * Go to any patron account * Hover over the 'dummy image' for the Add button * Browse and select an image for upload * Saving results in the following error: The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again. Apply patch and try again. You shouldn't need to try twice, it should work on the first attempt now. Created attachment 145346 [details] [review] Bug 31492: Set CSRF token in circulation.pl To test: * Turn on patronimages system preferences * Go to any patron account * Hover over the 'dummy image' for the Add button * Browse and select an image for upload * Saving results in the following error: The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again. Apply patch and try again. You shouldn't need to try twice, it should work on the first attempt now. Signed-off-by: David Nind <david@davidnind.com> Testing notes (using koha-testing-docker): 1. No error when using Firefox (on Kubuntu 22.04). After apply patch, continues to work as expected. 2. Error when using Chromium and Google Chrome. Applying the patch successfully fixes the issue. Created attachment 145347 [details] [review] Bug 31492: Set CSRF token in circulation.pl To test: * Turn on patronimages system preferences * Go to any patron account * Hover over the 'dummy image' for the Add button * Browse and select an image for upload * Saving results in the following error: The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again. Apply patch and try again. You shouldn't need to try twice, it should work on the first attempt now. Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Nice work everyone! Pushed to 23.05.x for the next release Nice work, thanks everyone! Pushed to 22.11.x for the next release. Backported to 22.05.x for upcoming 22.05.09 applied to 21.11.x for 21.11.16 Not backported to 21.05.x |