Bug 36597

Summary: Cannot delete circulation desk
Product: Koha Reporter: Owen Leonard <oleonard>
Component: System AdministrationAssignee: Owen Leonard <oleonard>
Status: CLOSED FIXED QA Contact: Martin Renvoize (ashimema) <martin.renvoize>
Severity: major    
Priority: P5 - low CC: blawlor, fridolin.somers, gmcharlt, martin.renvoize, pedro.amorim
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00
Circulation function:
Bug Depends on: 36192    
Bug Blocks:    
Attachments: Bug 36597: Fix deletion of circulation desks broken by CSRF
Bug 36597: Fix deletion of circulation desks broken by CSRF
Bug 36597: Fix deletion of circulation desks broken by CSRF

Description Owen Leonard 2024-04-12 12:30:44 UTC
Our CSRF work introduced a problem with deleting circulation desks: The "delete_confirm" does not need "cud-" because it's a GET operation leading to a POSTed deletion after the confirmation is submitted.
Comment 1 Owen Leonard 2024-04-12 12:33:45 UTC
Created attachment 164844 [details] [review]
Bug 36597: Fix deletion of circulation desks broken by CSRF

Our CSRF work introduced a problem with deleting circulation desks: The
"delete_confirm" does not need "cud-" because it's a GET operation
leading to a POSTed deletion after the confirmation is submitted.

To test, apply the patch and restart services.

- Go to Administration -> Circulation desks.
- If necessary, create a circulation desk.
- Click the "Delete" button for you new desk.
- You should be taken to a confirmation page which shows details of the
  desk you're deleting.
- Confirming the deletion should result in deletion of the desk.
Comment 2 Brendan Lawlor 2024-04-12 12:43:50 UTC
Created attachment 164845 [details] [review]
Bug 36597: Fix deletion of circulation desks broken by CSRF

Our CSRF work introduced a problem with deleting circulation desks: The
"delete_confirm" does not need "cud-" because it's a GET operation
leading to a POSTed deletion after the confirmation is submitted.

To test, apply the patch and restart services.

- Go to Administration -> Circulation desks.
- If necessary, create a circulation desk.
- Click the "Delete" button for you new desk.
- You should be taken to a confirmation page which shows details of the
  desk you're deleting.
- Confirming the deletion should result in deletion of the desk.

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Comment 3 Martin Renvoize (ashimema) 2024-04-17 09:55:51 UTC
Created attachment 164988 [details] [review]
Bug 36597: Fix deletion of circulation desks broken by CSRF

Our CSRF work introduced a problem with deleting circulation desks: The
"delete_confirm" does not need "cud-" because it's a GET operation
leading to a POSTed deletion after the confirmation is submitted.

To test, apply the patch and restart services.

- Go to Administration -> Circulation desks.
- If necessary, create a circulation desk.
- Click the "Delete" button for you new desk.
- You should be taken to a confirmation page which shows details of the
  desk you're deleting.
- Confirming the deletion should result in deletion of the desk.

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 4 Martin Renvoize (ashimema) 2024-04-17 09:56:09 UTC
Trivial fix, thanks Owen.

Passing QA
Comment 5 Katrin Fischer 2024-04-18 14:52:16 UTC
Pushed for 24.05!

Well done everyone, thank you!
Comment 6 Fridolin Somers 2024-05-22 12:21:29 UTC
23.11.x not impacted