Summary: | 403 Forbidden Error when attempting to search for Mana Reports | ||
---|---|---|---|
Product: | Koha | Reporter: | Kelly McElligott <kelly> |
Component: | Reports | Assignee: | Phil Ringnalda <phil> |
Status: | CLOSED FIXED | QA Contact: | Victor Grousset/tuxayo <victor> |
Severity: | major | ||
Priority: | P5 - low | CC: | alex.arnaud, cj.lynce, david, fridolin.somers, jzairo, lucas, martin.renvoize, phil, victor |
Version: | 24.05 | ||
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | --- | Documentation contact: | |
Documentation submission: | Text to go in the release notes: |
This fixes searching for a report in Mana when creating a new report. Searching Mana was generating an error message "Your search could not be completed. Please try again later. 403 Forbidden". (This is related to the CSRF changes added in Koha 24.05 to improve form security.)
|
|
Version(s) released in: |
24.11.00,24.05.04
|
Circulation function: | |
Bug Depends on: | 36192 | ||
Bug Blocks: | |||
Attachments: |
Bug 37093: Searching for reports on Mana should use GET
Bug 37093: Searching for reports on Mana should use GET Bug 37093: Searching for reports on Mana should use GET |
Description
Kelly McElligott
2024-06-14 14:56:47 UTC
That's because your search is sending a POST to /cgi-bin/koha/svc/mana/search without a CSRF token. https://git.koha-community.org/Koha-community/Koha/src/commit/10853d1edc9c31bcef096ffa514bb3025e0a760e/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt#L2394 is implicitly a POST because it passes an object to .load, but before bug 22250 cleaned things up in https://git.koha-community.org/Koha-community/Koha/commit/679fdaebb1a611859a968f22b85c37fbc00b055b it was explicitly a POST (which bizarrely attempted to include a biblionumber, which makes it look like it was originally poorly-chosen copy-paste). That line should instead be $("#mana_result_content").load("/cgi-bin/koha/svc/mana/search #mana_results", "resource=report&usecomments=1&id=" + textquery, function( response, status, xhr ) { That nicely returns results from the search, but were the results ever usable? What I get seems to be the result of replacing newlines with '' rather than with ' ' which garbles everything since it does things like "i.ccodeFROM old_reserves oLEFT JOIN items i" and the SQL parser chokes at oLEFT. Inconveniently placed line wrapping by Bugzilla, but "result of replacing newlines with nothing, rather than with a single space" is Ye Olde bug 24773. Created attachment 168809 [details] [review] Bug 37093: Searching for reports on Mana should use GET Searching for reports on Mana currently fails by sending a POST to svc/mana/search without a CSRF token. There's no reason to POST, it's just sending a search string. 1. Enable Mana: Reports - lower right is a blue Knowledgebase box with a link to Change your Mana KB settings 2. Switch Use Mana KB to Yes, click Save, below that give it a name and email, Send to Mana KB 3. Reports - Use saved - New report - New SQL from Mana 4. Enter any keyword to search, get a 403 forbidden error 5. Apply patch, restart_all, Shift+Reload the page to clear cache 6. Enter any keyword likely to return results, like select, get results And once I actually read the line about "Your Mana KB server is currently: https://mana-test.koha-community.org" the broken newline conversion could well be only on the test server, dunno. Created attachment 169920 [details] [review] Bug 37093: Searching for reports on Mana should use GET Searching for reports on Mana currently fails by sending a POST to svc/mana/search without a CSRF token. There's no reason to POST, it's just sending a search string. 1. Enable Mana: Reports - lower right is a blue Knowledgebase box with a link to Change your Mana KB settings 2. Switch Use Mana KB to Yes, click Save, below that give it a name and email, Send to Mana KB 3. Reports - Use saved - New report - New SQL from Mana 4. Enter any keyword to search, get a 403 forbidden error 5. Apply patch, restart_all, Shift+Reload the page to clear cache 6. Enter any keyword likely to return results, like select, get results Signed-off-by: David Nind <david@davidnind.com> Created attachment 169922 [details] [review] Bug 37093: Searching for reports on Mana should use GET Searching for reports on Mana currently fails by sending a POST to svc/mana/search without a CSRF token. There's no reason to POST, it's just sending a search string. 1. Enable Mana: Reports - lower right is a blue Knowledgebase box with a link to Change your Mana KB settings 2. Switch Use Mana KB to Yes, click Save, below that give it a name and email, Send to Mana KB 3. Reports - Use saved - New report - New SQL from Mana 4. Enter any keyword to search, get a 403 forbidden error 5. Apply patch, restart_all, Shift+Reload the page to clear cache 6. Enter any keyword likely to return results, like select, get results Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Works, makes sense, QA script happy, code looks good, passing QA :) Pushed for 24.11! Well done everyone, thank you! Can this be backported to 24.05? We use mana regularly. Thx! Backported to 24.05.x for upcoming 24.05.04 Not for 23.11.x |