Bug 36194

Summary: CSRF - svc (2/2)
Product: Koha Reporter: Nick Clemens (kidclamp) <nick>
Component: Architecture, internals, and plumbingAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: critical    
Priority: P5 - low CC: dcook, jonathan.druart
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 36094, 36084    
Bug Blocks: 36192    

Description Nick Clemens (kidclamp) 2024-02-28 14:01:20 UTC
This bug is for tracking follow-ups missed in the initial review. Please see the "svc" section on the framapad here:
https://annuel.framapad.org/p/koha_34478_remaining

Additional entries can be added there, and should be crossed out when completed

Patches should be attached here

This bug can be closed when that section of the pad is empty

see bug 36084 commits for new method using fetch/api-client.js is retrieved (and adjusted) from the Vue work

wiki/coding guideline to follow
Comment 2 Jonathan Druart 2024-02-29 07:54:07 UTC
(In reply to Nick Clemens from comment #1)
> https://wiki.koha-community.org/wiki/Coding_Guidelines#JS13:
> _Fetching_resources

Note that we do not necessarily need to use this method to fix the remaining svc occurrences.
We can simply reject non-POST requests, or add a cud op when missing.
Comment 3 Jonathan Druart 2024-02-29 07:54:37 UTC
Note that svc/authentication has its own bug 36094.