Summary: | Item search batch operations buttons broken by CSRF | ||
---|---|---|---|
Product: | Koha | Reporter: | Brendan Lawlor <blawlor> |
Component: | Cataloging | Assignee: | Brendan Lawlor <blawlor> |
Status: | RESOLVED FIXED | QA Contact: | Testopia <testopia> |
Severity: | major | ||
Priority: | P5 - low | CC: | fridolin.somers, m.de.rooy |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
24.05.00
|
|
Circulation function: | |||
Bug Depends on: | 34478 | ||
Bug Blocks: | 36192, 38413 | ||
Attachments: |
Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons
Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons |
Description
Brendan Lawlor
2024-04-17 20:40:29 UTC
Created attachment 165034 [details] [review] Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons This patch changes the form that submits to batchMod.pl from the Item search results page. The form method does not need to be a POST. To recreate: 1. Do an item search 2. On the results page 'click Select visible rows' 3. Click 'Batch operations' and select 'Batch item modification' 4. See Programming error - op 'show' must start with 'cud-' for POST http://localhost:8081/intranet/tools/batchMod.pl (referer: http://localhost:8081/cgi-bin/koha/catalogue/itemsearch.pl) 5. Click 'Batch operations' and select 'Batch item deletion' 6. See the same error To test: 1. Apply patch and repeat steps to recreate the issue 2. See that the batchMod.pl page loads with no error. Created attachment 165035 [details] [review] Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons This patch changes the form that submits to batchMod.pl from the Item search results page. The form method does not need to be a POST. To recreate: 1. Do an item search 2. On the results page 'click Select visible rows' 3. Click 'Batch operations' and select 'Batch item modification' 4. See Programming error - op 'show' must start with 'cud-' for POST http://localhost:8081/intranet/tools/batchMod.pl (referer: http://localhost:8081/cgi-bin/koha/catalogue/itemsearch.pl) 5. Click 'Batch operations' and select 'Batch item deletion' 6. See the same error To test: 1. Apply patch and repeat steps to recreate the issue 2. See that the batchMod.pl page loads with no error. Signed-off-by: David Nind <david@davidnind.com> Created attachment 165036 [details] [review] Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons This patch changes the form that submits to batchMod.pl from the Item search results page. The form method does not need to be a POST. To recreate: 1. Do an item search 2. On the results page 'click Select visible rows' 3. Click 'Batch operations' and select 'Batch item modification' 4. See Programming error - op 'show' must start with 'cud-' for POST http://localhost:8081/intranet/tools/batchMod.pl (referer: http://localhost:8081/cgi-bin/koha/catalogue/itemsearch.pl) 5. Click 'Batch operations' and select 'Batch item deletion' 6. See the same error To test: 1. Apply patch and repeat steps to recreate the issue 2. See that the batchMod.pl page loads with no error. Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Pushed for 24.05! Well done everyone, thank you! |