Bug 36305

Summary: Inventory tools need adjustments for CSRF
Product: Koha Reporter: Nick Clemens (kidclamp) <nick>
Component: ToolsAssignee: Kyle M Hall (khall) <kyle>
Status: RESOLVED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: normal    
Priority: P5 - low CC: david, dcook, fridolin.somers, kyle, m.de.rooy, phil
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00
Circulation function:
Bug Depends on:    
Bug Blocks: 36192    
Attachments: Bug 36305: Tidy forms
Bug 36305: Implement op paramters
Bug 36305: Tidy forms
Bug 36305: Implement op paramters
Bug 36305: Tidy forms
Bug 36305: Implement op paramters
Bug 36305: (QA follow-up) Enforce op values in script

Description Nick Clemens (kidclamp) 2024-03-13 12:35:18 UTC
The main forms don't use 'op' other than checking for the existence

Problem follow-ups use an ajax post
Comment 1 Kyle M Hall (khall) 2024-03-13 16:24:12 UTC
Created attachment 163114 [details] [review]
Bug 36305: Tidy forms
Comment 2 Kyle M Hall (khall) 2024-03-13 16:24:19 UTC
Created attachment 163115 [details] [review]
Bug 36305: Implement op paramters
Comment 3 David Nind 2024-03-14 23:50:50 UTC
Created attachment 163153 [details] [review]
Bug 36305: Tidy forms

Signed-off-by: David Nind <david@davidnind.com>
Comment 4 David Nind 2024-03-14 23:50:52 UTC
Created attachment 163154 [details] [review]
Bug 36305: Implement op paramters

Signed-off-by: David Nind <david@davidnind.com>
Comment 5 David Nind 2024-03-15 00:00:07 UTC
Testing notes (using KTD):

1. Apply the patches.
2. Test the cataloging inventory tool - it should work as expected. I:
   2.1 Exported a list of barcodes (using item search to export a list of all the barcodes)
   2.2 Ran the inventory tool:
       . Used the barcode file under the "Use a barcode file"
       . I didn't select any additional items
       . Submit
       . Say 'OK' to the message about you have not selected any filters, and that it could take a while
3. BONUS: Apply the patches on top of bug 36190 - all the tests should pass: prove -v xt/find-missing-op-in-forms.t
Comment 6 Marcel de Rooy 2024-03-15 08:26:21 UTC
The template changes are extensive, hard to check one by one..
Comment 7 Marcel de Rooy 2024-03-15 08:27:04 UTC
Created attachment 163171 [details] [review]
Bug 36305: Tidy forms

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 8 Marcel de Rooy 2024-03-15 08:27:07 UTC
Created attachment 163172 [details] [review]
Bug 36305: Implement op paramters

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 9 Marcel de Rooy 2024-03-15 08:27:09 UTC
Created attachment 163173 [details] [review]
Bug 36305: (QA follow-up) Enforce op values in script

Replacing a FIXME by TODO along the way.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 10 Katrin Fischer 2024-03-15 08:40:22 UTC
Pushed for 24.05!

Well done everyone, thank you!
Comment 11 Fridolin Somers 2024-03-18 09:07:09 UTC
Depends on Bug 34478 right ?
Comment 12 Phil Ringnalda 2024-10-25 12:32:35 UTC
Depends or blocks, it's CSRF, not in 23.11

(In reply to Nick Clemens (kidclamp) from comment #0)
> Problem follow-ups use an ajax post

Which didn't work, but was fixed in bug 37961