Summary: | CSRF - testing reports | ||
---|---|---|---|
Product: | Koha | Reporter: | Nick Clemens (kidclamp) <nick> |
Component: | Architecture, internals, and plumbing | Assignee: | Bugs List <koha-bugs> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | critical | ||
Priority: | P5 - low | CC: | blawlor, caroline.cyr-la-rose, dcook, ddaghita, egpetridis, fridolin.somers, jonathan.druart, lucas, martin.renvoize, victor |
Version: | Main | Keywords: | collector |
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Bug Depends on: | 34478 | ||
Bug Blocks: | 36192, 36349 | ||
Attachments: |
Bug 36195: serials/routing-preview.pl - Fix save and preview
Bug 36195: Replace POST batch_records_ajax.pl with GET Bug 36195: Replace POST in itemsearch.tt with GET Bug 36195: Replace POST in itemsearch.tt with GET |
Description
Nick Clemens (kidclamp)
2024-02-28 14:02:46 UTC
Created attachment 162668 [details] [review] Bug 36195: serials/routing-preview.pl - Fix save and preview No idea why we are passing issue_escaped instead of the id, but this patch fixes the regression. Hi, I'm not sure if this is where I should report this. I added it to the framapad, too... I can't search for items using the item search. It returns a 403: Forbidden message. To recreate: 1. Go to Item search 2. Click Search --> 403: Forbidden plack-intranet-error.log says [2024/03/05 22:06:45] [WARN] Programming error - op 'like' must start with 'cud-' for POST at /kohadevbox/koha/Koha/Middleware/CSRF.pm line 78. (In reply to Caroline Cyr La Rose from comment #2) > I can't search for items using the item search. It returns a 403: Forbidden > message. I've looked into this one a bit (as I noticed on framapad), and I think itemsearch.pl is going to require some refactoring to fix its usage of "op". Basically, the "op" in the GET is fine, but it gets used for the POST to the API too. Could maybe convert that second POST to a GET, although it would be a long URL... Created attachment 162960 [details] [review] Bug 36195: Replace POST batch_records_ajax.pl with GET We retrieve a list of records for DT, it does not need to be a POST request. Test plan: 1. Stage a batch 2. When it's done, click on "view batch" => Without this patch the page loads but pops an alert that says "403: Forbidden" and table stays empty *** Bug 36280 has been marked as a duplicate of this bug. *** Created attachment 163049 [details] [review] Bug 36195: Replace POST in itemsearch.tt with GET Created attachment 163050 [details] [review] Bug 36195: Replace POST in itemsearch.tt with GET We retrieve a list of records for DT, it does not need to be a POST request. Test plan: 1. Try an item search 2. The page loads but pops an alert that says "403: Forbidden" and table stays empty 3. Apply patch 4. Try an item search again and the table loads results Comment on attachment 163050 [details] [review] Bug 36195: Replace POST in itemsearch.tt with GET >From 28f445587ee8e7f70852367f2c9e37ae2c4ebcea Mon Sep 17 00:00:00 2001 >From: Brendan Lawlor <blawlor@clamsnet.org> >Date: Mon, 11 Mar 2024 17:32:08 +0000 >Subject: [PATCH] Bug 36195: Replace POST in itemsearch.tt with GET > >We retrieve a list of records for DT, it does not need to be a POST >request. > >Test plan: > >1. Try an item search >2. The page loads but pops an alert that says "403: Forbidden" and table stays empty >3. Apply patch >4. Try an item search again and the table loads results >--- > koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt | 1 - > 1 file changed, 1 deletion(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt >index b3a89e508c..db703115b3 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt >@@ -478,7 +478,6 @@ > "processing": true, > "ajax": { > url: '/cgi-bin/koha/catalogue/itemsearch.pl', >- type: 'POST', > data: function ( d ) { > for (i in params) { > d[params[i].name] = params[i].value; >-- >2.30.2 Last 3 patches pushed to master and obsoleted here. Thanks! I reported the issue corresponding to Bug 36280 in the pad just a day before promulgation of directive «Please file individual bugs to deal with remaining issues per RM request» Just writing here to be sure that report didn't slip under the radar due to being right before the change in strategy for CSRF related regressions. (In reply to Victor Grousset/tuxayo from comment #10) > I reported the issue corresponding to Bug 36280 in the pad just a day before > promulgation of directive «Please file individual bugs to deal with > remaining issues per RM request» > > Just writing here to be sure that report didn't slip under the radar due to > being right before the change in strategy for CSRF related regressions. I pushed all patches on this and the other CSRF bug today. So this is just for future bugs. Depends on Bug 34478 no ? (In reply to Fridolin Somers from comment #12) > Depends on Bug 34478 no ? Yep. I've just added as dependency. I see on the pad «Make sure to file as blocker for 36192» So I might have linked bug 36349 in the wrong way. Does it mean that other bugs need be listed here in "depends on"? Like an omnibus. Indeed, I'm looking at graph from Bug 34478 and this dependancy looks wrong Could bug https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37978 be related? Almost sure not: bug 37978 comment 10 I'm not really seeing much use of this bug.. should we close it at this point as I'm not sure it's really serving any meaningful purpose. (In reply to Martin Renvoize (ashimema) from comment #18) > I'm not really seeing much use of this bug.. should we close it at this > point as I'm not sure it's really serving any meaningful purpose. Yeah I've been thinking that lately too |