Bug 37080

Summary:	Cannot delete a MARC bibliographic framework or authority type
Product:	Koha	Reporter:	David Nind <david>
Component:	Cataloging	Assignee:	Phil Ringnalda <phil>
Status:	RESOLVED FIXED	QA Contact:	Martin Renvoize (ashimema) <martin.renvoize>
Severity:	major
Priority:	P5 - low	CC:	emily.lamancusa, fridolin.somers, lucas, m.de.rooy, martin.renvoize, phil
Version:	Main
Hardware:	All
OS:	All
See Also:	https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37089 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37090 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37091
Change sponsored?:	---	Patch complexity:	Trivial patch
Documentation contact:		Documentation submission:
Text to go in the release notes:	This fixes the forms so that you can now delete MARC bibliographic frameworks and authority types. (This is related to the CSRF changes added in Koha 24.05 to improve form security.)	Version(s) released in:	24.11.00,24.05.02
Circulation function:
Bug Depends on:	36192
Bug Blocks:
Attachments:	Bug 37080: Cannot delete MARC bibliographic frameworks or authority types Bug 37080: Cannot delete MARC bibliographic frameworks or authority types Bug 37080: Cannot delete MARC bibliographic frameworks or authority types

Description David Nind 2024-06-12 19:38:52 UTC

On current main (and 24.05) you cannot delete a MARC bibliographic framework.

Reported on chat (13 June 2024) for 24.05.00 and reproduced on main.

Steps to reproduce:
1. Go to Koha administration > Catalog > MARC bibliographic frameworks.
2. For a framework, select Actions > Delete.
3. Message displayed: "Confirm deletion of framework '' ()?" (with options under this - "Yes, delete this framework" and "No, do not delete") (note that the URL has the framework code /cgi-bin/koha/admin/biblio_framework.pl?op=delete_confirm&frameworkcode=ACQ)
4. Click "Yes, delete this framework".
5. Error message displayed: "An error occurred when deleting this framework. Check the logs for details."
6. Nothing in the logs that seems of any help (/var/logs/koha/kohadev/* - where kohadev is the instance name).

Other observations:
1. If you create a new framework (without adding any MARC structure) and attempt to delete, you get the same error. So not related records using the framework. 
2. No JavaScript or other browser console errors using the browser's web development tools.

Comment 1 Phil Ringnalda 2024-06-13 02:43:33 UTC

Created attachment 167680 [details] [review]
Bug 37080: Cannot delete MARC bibliographic frameworks or authority types

The scripts for managing both bib and authority frameworks are now expecting
an op 'cud-delete_confirm' but delete_confirm isn't cud, it's just a GET of a
page asking if you are sure. The scripts just need to expect the op they are
actually getting, delete_confirm.

Test plan:
 1. Administration - MARC bibliographic framework - New framework
 2. Give the framework any code and description and Submit
 3. Actions menu for your new framework - Delete
 4. Note the message says 'Confirm deletion of framework '' ()?" rather than
    having the code and description included.
 5. Click Yes, note that deleting failed
 6. Administration - Authority types - New authority type
 7. Give the authority type any type and description and Submit
 8. Actions menu for your authority type - Delete
 9. Note the message again says '' () rather than 'desc' (FOO)
10. Click yes, note that deleting failed
11. Finally! Apply patch, reset_all
12. Repeat steps 1-10, this time noting that you get 'desc' (FOO) rather than
    '' (), and that deleting works.

Comment 2 David Nind 2024-06-13 09:22:36 UTC

Created attachment 167682 [details] [review]
Bug 37080: Cannot delete MARC bibliographic frameworks or authority types

The scripts for managing both bib and authority frameworks are now expecting
an op 'cud-delete_confirm' but delete_confirm isn't cud, it's just a GET of a
page asking if you are sure. The scripts just need to expect the op they are
actually getting, delete_confirm.

Test plan:
 1. Administration - MARC bibliographic framework - New framework
 2. Give the framework any code and description and Submit
 3. Actions menu for your new framework - Delete
 4. Note the message says 'Confirm deletion of framework '' ()?" rather than
    having the code and description included.
 5. Click Yes, note that deleting failed
 6. Administration - Authority types - New authority type
 7. Give the authority type any type and description and Submit
 8. Actions menu for your authority type - Delete
 9. Note the message again says '' () rather than 'desc' (FOO)
10. Click yes, note that deleting failed
11. Finally! Apply patch, reset_all
12. Repeat steps 1-10, this time noting that you get 'desc' (FOO) rather than
    '' (), and that deleting works.

Signed-off-by: David Nind <david@davidnind.com>

Comment 3 David Nind 2024-06-13 09:23:25 UTC

Thanks Phil for creating a patch so quickly!

Comment 4 David Nind 2024-06-13 21:16:49 UTC

Can confirm that the patch fixes the issue for both MARC frameworks and authority types.

Comment 5 Martin Renvoize (ashimema) 2024-06-14 10:53:43 UTC

Created attachment 167711 [details] [review]
Bug 37080: Cannot delete MARC bibliographic frameworks or authority types

The scripts for managing both bib and authority frameworks are now expecting
an op 'cud-delete_confirm' but delete_confirm isn't cud, it's just a GET of a
page asking if you are sure. The scripts just need to expect the op they are
actually getting, delete_confirm.

Test plan:
 1. Administration - MARC bibliographic framework - New framework
 2. Give the framework any code and description and Submit
 3. Actions menu for your new framework - Delete
 4. Note the message says 'Confirm deletion of framework '' ()?" rather than
    having the code and description included.
 5. Click Yes, note that deleting failed
 6. Administration - Authority types - New authority type
 7. Give the authority type any type and description and Submit
 8. Actions menu for your authority type - Delete
 9. Note the message again says '' () rather than 'desc' (FOO)
10. Click yes, note that deleting failed
11. Finally! Apply patch, reset_all
12. Repeat steps 1-10, this time noting that you get 'desc' (FOO) rather than
    '' (), and that deleting works.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Comment 6 Martin Renvoize (ashimema) 2024-06-14 10:54:01 UTC

Thanks for the quick correction here.

Comment 7 Emily Lamancusa (emlam) 2024-06-14 13:58:20 UTC

Thanks, all!

Looks like there are a few more pages where this correction needs to be made...filing additional bugs.

Comment 8 Katrin Fischer 2024-06-21 13:04:37 UTC

Pushed for 24.11!

Well done everyone, thank you!

Comment 9 Lucas Gass (lukeg) 2024-07-18 19:22:20 UTC

Backported to 24.05.x for upcoming 24.05.02

Comment 10 Fridolin Somers 2024-07-19 08:34:32 UTC

Full CSRF not in 23.11.x

Comment 11 David Nind 2024-07-22 04:07:10 UTC

No changes required to the manual. This fixes forms so that they work. No screenshots need updating, and the task for deleting a framework (bibliographic or authority type) is not explicitly covered.