| Summary: | Can't delete news from the staff interface main page | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Emily-Rose Francoeur <emily-rose.francoeur> |
| Component: | Staff interface | Assignee: | Emily-Rose Francoeur <emily-rose.francoeur> |
| Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | caroline.cyr-la-rose, dcook, emily-rose.francoeur, fridolin.somers, gmcharlt, m.de.rooy, philippe.blouin |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
23.11.00,23.05.05,22.11.12
|
|
| Circulation function: | |||
| Bug Depends on: | 34368 | ||
| Bug Blocks: | |||
| Attachments: |
Bug 35019: Add a CSRF token when deleting news
Bug 35019: Add a CSRF token when deleting news Bug 35019: Add a CSRF token when deleting news Bug 35019: Add a CSRF token when deleting news |
||
|
Description
Emily-Rose Francoeur
2023-10-10 15:44:06 UTC
Created attachment 156801 [details] [review] Bug 35019: Add a CSRF token when deleting news I add a CSRF token as a parameter in the link for deleting a news entry, which solves the problem. TEST PLAN 1) Apply the patch 2) Go to “Tools > News > New entry” 3) “Display location” should be set to “Staff interface” 4) Fill in the fields 5) Return to the homepage 6) Delete the created news entry 7) The “Additional contents” page is displayed, and the deleted news entry no longer appears 8) Return to the homepage; the news entry no longer displays Created attachment 156802 [details] [review] Bug 35019: Add a CSRF token when deleting news I add a CSRF token as a parameter in the link for deleting a news entry, which solves the problem. TEST PLAN 1) Apply the patch 2) Go to "Tools > News > New entry" 3) "Display location" should be set to "Staff interface" 4) Fill in the fields 5) Return to the homepage 6) Delete the created news entry 7) The "Additional contents" page is displayed, and the deleted news entry no longer appears 8) Return to the homepage; the news entry no longer displays Created attachment 156822 [details] [review] Bug 35019: Add a CSRF token when deleting news I add a CSRF token as a parameter in the link for deleting a news entry, which solves the problem. TEST PLAN 1) Apply the patch 2) Go to "Tools > News > New entry" 3) "Display location" should be set to "Staff interface" 4) Fill in the fields 5) Return to the homepage 6) Delete the created news entry 7) The "Additional contents" page is displayed, and the deleted news entry no longer appears 8) Return to the homepage; the news entry no longer displays Signed-off-by: Owen Leonard <oleonard@myacpl.org> Created attachment 157215 [details] [review] Bug 35019: Add a CSRF token when deleting news I add a CSRF token as a parameter in the link for deleting a news entry, which solves the problem. TEST PLAN 1) Apply the patch 2) Go to "Tools > News > New entry" 3) "Display location" should be set to "Staff interface" 4) Fill in the fields 5) Return to the homepage 6) Delete the created news entry 7) The "Additional contents" page is displayed, and the deleted news entry no longer appears 8) Return to the homepage; the news entry no longer displays Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Pushed to master for 23.11. Nice work everyone, thanks! Pushed to 23.05.x for 23.05.05 On a side note, generally speaking, we want to avoid putting CSRF tokens in GET requests, and we want to avoid state changes via GET requests. This could've been an opportunity to refactor this delete to use a POST instead. At some point, I think we'll update the coding guidelines to reflect that, but just a FYI to folk. Nice work everyone! Pushed to oldstable for 22.11.x |