| Summary: | Comment approval and un-approval should be CSRF-protected | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Owen Leonard <oleonard> |
| Component: | OPAC | Assignee: | Owen Leonard <oleonard> |
| Status: | Needs documenting --- | QA Contact: | Testopia <testopia> |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | dcook, didier.gautheron, fridolin.somers, jonathan.druart, laurent.ducos, lisette, lucas, m.de.rooy, martin.renvoize, nick, philippe.blouin, tomascohen, wainuiwitikapark |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
24.11.00,24.05.02
|
|
| Circulation function: | |||
| Bug Depends on: | |||
| Bug Blocks: | 2486 | ||
| Attachments: |
Bug 37074: Comment approval and un-approval should be CSRF-protected
Bug 37074: Comment approval and un-approval should be CSRF-protected Bug 37074: Comment approval and un-approval should be CSRF-protected Bug 37074: Do no pass biblionumber |
||
|
Description
Owen Leonard
2024-06-12 12:32:46 UTC
Created attachment 167671 [details] [review] Bug 37074: Comment approval and un-approval should be CSRF-protected This patch converts the "Approve" and "Unapprove" controls in the staff client's comment moderation page so that the operations are POST instead of GET. To test, apply the patch and restart services. - If necessary, enable OPACComments and submit a few comments on a few titles in the OPAC - Go to Tools -> Comments - Test the process of approving, unapproving, and deleting comments Created attachment 167702 [details] [review] Bug 37074: Comment approval and un-approval should be CSRF-protected This patch converts the "Approve" and "Unapprove" controls in the staff client's comment moderation page so that the operations are POST instead of GET. To test, apply the patch and restart services. - If necessary, enable OPACComments and submit a few comments on a few titles in the OPAC - Go to Tools -> Comments - Test the process of approving, unapproving, and deleting comments Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> Created attachment 167707 [details] [review] Bug 37074: Comment approval and un-approval should be CSRF-protected This patch converts the "Approve" and "Unapprove" controls in the staff client's comment moderation page so that the operations are POST instead of GET. To test, apply the patch and restart services. - If necessary, enable OPACComments and submit a few comments on a few titles in the OPAC - Go to Tools -> Comments - Test the process of approving, unapproving, and deleting comments Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Created attachment 167708 [details] [review] Bug 37074: Do no pass biblionumber It is not used in the controller Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Patch doesn't apply cleanly for 23.05.x, could this please be rebased? Hi Wainui, this used cud- from the big CSRF bug, so it doesn't apply beyond 24.05. (In reply to Katrin Fischer from comment #6) > Hi Wainui, this used cud- from the big CSRF bug, so it doesn't apply beyond > 24.05. Ok, thanks! This has been backported to 24.05.x-security branch for 24.05.02 Pushed for 24.11! Well done everyone, thank you! CSRF with "cud-" not backported to 23.11.x |