Bug 36630

Summary: Item search batch operations buttons broken by CSRF
Product: Koha Reporter: Brendan Lawlor <blawlor>
Component: CatalogingAssignee: Brendan Lawlor <blawlor>
Status: RESOLVED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: fridolin.somers, m.de.rooy
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00
Circulation function:
Bug Depends on: 34478    
Bug Blocks: 36192, 38413    
Attachments: Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons
Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons
Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons

Description Brendan Lawlor 2024-04-17 20:40:29 UTC
Since Bug 34478 Full CSRF protection some POST requests return 403 with an error and need to be ajusted.

On the Item search results page, the Batch operations buttons are broken and need to be changed to GET.


To recreate:

1. Do an item search
2. On the results page 'click Select visible rows'
3. Click 'Batch operations' and select 'Batch item modification'
4. See Programming error - op 'show' must start with 'cud-' for POST http://localhost:8081/intranet/tools/batchMod.pl (referer: http://localhost:8081/cgi-bin/koha/catalogue/itemsearch.pl)
5. Click 'Batch operations' and select 'Batch item deletion'
6. See the same error
Comment 1 Brendan Lawlor 2024-04-17 20:58:35 UTC Comment hidden (obsolete)
Comment 2 David Nind 2024-04-18 02:26:46 UTC
Created attachment 165035 [details] [review]
Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons

This patch changes the form that submits to batchMod.pl from the Item search results page. The form method does not need to be a POST.

    To recreate:

    1. Do an item search
    2. On the results page 'click Select visible rows'
    3. Click 'Batch operations' and select 'Batch item modification'
    4. See Programming error - op 'show' must start with 'cud-' for POST http://localhost:8081/intranet/tools/batchMod.pl (referer: http://localhost:8081/cgi-bin/koha/catalogue/itemsearch.pl)
    5. Click 'Batch operations' and select 'Batch item deletion'
    6. See the same error

    To test:
    1. Apply patch and repeat steps to recreate the issue
    2. See that the batchMod.pl page loads with no error.

Signed-off-by: David Nind <david@davidnind.com>
Comment 3 Jonathan Druart 2024-04-18 06:47:49 UTC
Created attachment 165036 [details] [review]
Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons

This patch changes the form that submits to batchMod.pl from the Item search results page. The form method does not need to be a POST.

    To recreate:

    1. Do an item search
    2. On the results page 'click Select visible rows'
    3. Click 'Batch operations' and select 'Batch item modification'
    4. See Programming error - op 'show' must start with 'cud-' for POST http://localhost:8081/intranet/tools/batchMod.pl (referer: http://localhost:8081/cgi-bin/koha/catalogue/itemsearch.pl)
    5. Click 'Batch operations' and select 'Batch item deletion'
    6. See the same error

    To test:
    1. Apply patch and repeat steps to recreate the issue
    2. See that the batchMod.pl page loads with no error.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 4 Katrin Fischer 2024-04-18 14:52:23 UTC
Pushed for 24.05!

Well done everyone, thank you!
Comment 5 Fridolin Somers 2024-05-22 12:21:56 UTC
Depends on Bug 34478 not in 23.11.x