Bug 34601

Summary: Cannot manage suggestions without CSRF error
Product: Koha Reporter: Lucas Gass (lukeg) <lucas>
Component: CirculationAssignee: Lucas Gass (lukeg) <lucas>
Status: CLOSED FIXED QA Contact: Katrin Fischer <katrin.fischer>
Severity: major    
Priority: P5 - low CC: 1joynelson, apirak, dcook, didier.gautheron, fridolin.somers, gmcharlt, jbalway, jonathan.druart, kebliss, kelly, kyle.m.hall, laurent.ducos, lucas, m.de.rooy, martin.renvoize, matt.blenkinsop, nick, pedro.amorim, tomascohen
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34080
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.11.00,23.05.04,22.11.10,22.05.16
Circulation function:
Bug Depends on: 22990    
Bug Blocks:    
Attachments: Bug 34601: Pass module into params
Bug 34601: Fix edit/delete links on suggestion.tt
Bug 34601: Fix edit/delete links on suggestion.tt
Bug 34601: Fix edit/delete links on suggestion.tt
Bug 34601: (QA follow-up) Fix edit/delete links in toolbar
Bug 34601: [22.11.x]Fix edit/delete links on suggestion.tt
Bug 34601: Fix wrong quote
Bug 34601: [22.05.x] Fix edit/delete links on suggestion.tt

Description Lucas Gass (lukeg) 2023-08-23 17:45:47 UTC
To recreate: 

1. Make a suggestion 
2. Try to edit, delete, or manage the suggestion. 
3. Error: 

The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.
Comment 1 Lucas Gass (lukeg) 2023-08-23 17:47:13 UTC
It looks like the params->{module} doesn't get passed so it output_and_exit_if_error exits.
Comment 2 Lucas Gass (lukeg) 2023-08-23 17:48:53 UTC
Created attachment 154719 [details] [review]
Bug 34601: Pass module into params

1. Make a suggestion
2. Try to edit, delete, or manage the suggestion.
3. Error:
4. Apply patch and restart_all
5. Try again and you should not get the error anymore.
Comment 3 Lucas Gass (lukeg) 2023-08-23 18:20:30 UTC
Created attachment 154720 [details] [review]
Bug 34601: Fix edit/delete links on suggestion.tt

1. Make a suggestion
2. Try to edit, delete the suggestion.
3. Error:
4. Apply patch and restart_all
5. Try again and you should not get the error anymore.
Comment 4 Lucas Gass (lukeg) 2023-08-23 18:25:47 UTC
Marked as major as it prevents libraries from managing suggestions.
Comment 5 Andrew Fuerste-Henry 2023-08-23 21:17:39 UTC
Created attachment 154724 [details] [review]
Bug 34601: Fix edit/delete links on suggestion.tt

1. Make a suggestion
2. Try to edit, delete the suggestion.
3. Error:
4. Apply patch and restart_all
5. Try again and you should not get the error anymore.

Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>
Comment 6 Katrin Fischer 2023-08-24 19:36:35 UTC
Lucas, please remember to run the new perltidy on your changes and the QA test tools! (I amended the patch)
Comment 7 Katrin Fischer 2023-08-24 19:50:05 UTC
Created attachment 154747 [details] [review]
Bug 34601: Fix edit/delete links on suggestion.tt

1. Make a suggestion
2. Try to edit, delete the suggestion.
3. Error:
4. Apply patch and restart_all
5. Try again and you should not get the error anymore.

Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 8 Katrin Fischer 2023-08-24 19:50:09 UTC
Created attachment 154748 [details] [review]
Bug 34601: (QA follow-up) Fix edit/delete links in toolbar

We also need to fix the links in the toolbar visible when
'viewing' the suggestion.

1) Create a suggestion
2) Click on the title
3) Click edit > CSRF error
4) Click delete link in toolbar > CSRF error
5) Apply patch and repeat

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 9 Lucas Gass (lukeg) 2023-08-24 21:52:37 UTC
Created attachment 154762 [details] [review]
Bug 34601: [22.11.x]Fix edit/delete links on suggestion.tt
Comment 10 Katrin Fischer 2023-08-24 22:50:50 UTC
Lucas, did you see my follow-up? the original patch was incomplete.
Comment 11 Lucas Gass (lukeg) 2023-08-24 23:14:44 UTC
(In reply to Katrin Fischer from comment #10)
> Lucas, did you see my follow-up? the original patch was incomplete.

Yes, I did. Thanks! I squashed those together for the 22.11 one.
Comment 12 Katrin Fischer 2023-08-24 23:22:06 UTC
(In reply to Lucas Gass from comment #11)
> (In reply to Katrin Fischer from comment #10)
> > Lucas, did you see my follow-up? the original patch was incomplete.
> 
> Yes, I did. Thanks! I squashed those together for the 22.11 one.

All good then :)
Comment 13 Martin Renvoize (ashimema) 2023-08-25 06:46:54 UTC
Beware.. I think the archive/unarchive links also need the same treatment ;P
Comment 14 Katrin Fischer 2023-08-25 09:53:35 UTC
I'll look into providing another follow-up.
Comment 15 Katrin Fischer 2023-08-25 09:55:32 UTC
(In reply to Martin Renvoize from comment #13)
> Beware.. I think the archive/unarchive links also need the same treatment ;P

I just tested the archiving and unarchiving of a suggestion and they still work without any error with the other 2 patches applied.
Comment 16 Martin Renvoize (ashimema) 2023-08-25 10:07:40 UTC
Excellent, that's good news. Thanks for testing it.
Comment 17 Tomás Cohen Arazi (tcohen) 2023-08-29 12:44:06 UTC
The need for the follow-up makes it suspicious. Aren't we over-requiring CSRF tokens here?
Comment 18 Tomás Cohen Arazi (tcohen) 2023-08-29 17:36:48 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 19 Fridolin Somers 2023-08-30 06:43:57 UTC
Ich,

Typo in commit of master :

https://git.koha-community.org/Koha-community/Koha/src/commit/7d5dc65867a55045fa32189d177379e70ecf5725/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt#L850

<a class="deletesuggestion" href="suggestion.pl?op=delete&amp;suggestionid=[% s.suggestionid | html %]"&amp;csrf_token=[% csrf_token | html %]>

Double quote misplaced.
Comment 20 Kelly McElligott 2023-08-30 11:42:17 UTC
Can we get this backported?
Comment 21 Tomás Cohen Arazi (tcohen) 2023-08-30 11:52:45 UTC
Created attachment 154951 [details] [review]
Bug 34601: Fix wrong quote

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 22 Tomás Cohen Arazi (tcohen) 2023-08-30 11:54:07 UTC
(In reply to Fridolin Somers from comment #19)
> Ich,
> 
> Typo in commit of master :

Thanks!
Comment 23 Fridolin Somers 2023-08-30 19:56:02 UTC
Pushed to 23.05.x for 23.05.04
Comment 24 Matt Blenkinsop 2023-08-31 10:37:19 UTC
Nice work everyone!

Pushed to oldstable for 22.11.x
Comment 25 Matt Blenkinsop 2023-08-31 10:37:48 UTC
Thanks for the 22.11 patch!
Comment 26 apirak 2023-09-20 09:22:32 UTC
It happend on 22.05.15. Can we get this backported?
Comment 27 Lucas Gass (lukeg) 2023-09-22 18:26:50 UTC
Created attachment 156122 [details] [review]
Bug 34601: [22.05.x] Fix edit/delete links on suggestion.tt
Comment 28 Lucas Gass (lukeg) 2023-09-22 18:28:32 UTC
Backported to 22.05.x for upcoming 22.05.16