Bug 37039

Summary: Cannot request a discharge in the OPAC
Product: Koha Reporter: Owen Leonard <oleonard>
Component: OPACAssignee: Owen Leonard <oleonard>
Status: RESOLVED FIXED QA Contact: Julian Maurice <julian.maurice>
Severity: major    
Priority: P5 - low CC: david, fridolin.somers, julian.maurice, lucas
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
This fixes the OPAC discharge request so that it now works as expected - after pressing the "Ask for a discharge" button, the page was refreshed but no request was made. (Requires useDischarge system preference enabled; OPAC > Your account > Ask for a discharge.) (This is related to the CSRF changes added in Koha 24.05 to improve form security.)
Version(s) released in:
24.11.00,24.05.02
Circulation function:
Bug Depends on: 34478    
Bug Blocks:    
Attachments: Bug 37039: Update discharge request with CSRF token
Bug 37039: Update discharge request with CSRF token
Bug 37039: Update discharge request with CSRF token

Description Owen Leonard 2024-06-05 18:04:42 UTC
The page needs to be updated with a valid CSRF form.
Comment 1 Owen Leonard 2024-06-05 18:11:11 UTC
Created attachment 167490 [details] [review]
Bug 37039: Update discharge request with CSRF token

The OPAC discharge page used a link with a GET parameter, but the script
expects a POST request. This patch converts the link to a form with CSRF
token included.

To test, apply the patch and enable the useDischarge system preference
if necessary.

- Log in to the OPAC as a user with no checkouts or outstanding fees.
- Click the "Ask for discharge" tab in the sidebar of the user summary
  page.
- Click the "Ask for a discharge" button.
- You should be redirected to a page that says "Your discharge request
  has been sent."
Comment 2 David Nind 2024-06-05 20:18:10 UTC
Created attachment 167497 [details] [review]
Bug 37039: Update discharge request with CSRF token

The OPAC discharge page used a link with a GET parameter, but the script
expects a POST request. This patch converts the link to a form with CSRF
token included.

To test, apply the patch and enable the useDischarge system preference
if necessary.

- Log in to the OPAC as a user with no checkouts or outstanding fees.
- Click the "Ask for discharge" tab in the sidebar of the user summary
  page.
- Click the "Ask for a discharge" button.
- You should be redirected to a page that says "Your discharge request
  has been sent."

Signed-off-by: David Nind <david@davidnind.com>
Comment 3 Julian Maurice 2024-06-07 13:07:04 UTC
Created attachment 167575 [details] [review]
Bug 37039: Update discharge request with CSRF token

The OPAC discharge page used a link with a GET parameter, but the script
expects a POST request. This patch converts the link to a form with CSRF
token included.

To test, apply the patch and enable the useDischarge system preference
if necessary.

- Log in to the OPAC as a user with no checkouts or outstanding fees.
- Click the "Ask for discharge" tab in the sidebar of the user summary
  page.
- Click the "Ask for a discharge" button.
- You should be redirected to a page that says "Your discharge request
  has been sent."

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Comment 4 Martin Renvoize (ashimema) 2024-06-10 11:04:09 UTC
Thanks for all the hard work!

Pushed to main for the next 24.11.00 release as RM Assistant
Comment 5 Lucas Gass (lukeg) 2024-06-27 21:54:28 UTC
Backported to 24.05.x for upcoming 24.05.02
Comment 6 Fridolin Somers 2024-07-17 13:15:36 UTC
Depends on Bug 34478 not in 23.11.x
Comment 7 David Nind 2024-08-01 14:41:57 UTC
No change required to the manual - fixes something not working. No changes to screenshots in the OAPC section required.