Bug 37093

Summary: 403 Forbidden Error when attempting to search for Mana Reports
Product: Koha Reporter: Kelly McElligott <kelly>
Component: ReportsAssignee: Phil Ringnalda <phil>
Status: CLOSED FIXED QA Contact: Victor Grousset/tuxayo <victor>
Severity: major    
Priority: P5 - low CC: alex.arnaud, cj.lynce, david, fridolin.somers, jzairo, lucas, martin.renvoize, phil, victor
Version: 24.05   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
This fixes searching for a report in Mana when creating a new report. Searching Mana was generating an error message "Your search could not be completed. Please try again later. 403 Forbidden". (This is related to the CSRF changes added in Koha 24.05 to improve form security.)
Version(s) released in:
24.11.00,24.05.04
Circulation function:
Bug Depends on: 36192    
Bug Blocks:    
Attachments: Bug 37093: Searching for reports on Mana should use GET
Bug 37093: Searching for reports on Mana should use GET
Bug 37093: Searching for reports on Mana should use GET

Description Kelly McElligott 2024-06-14 14:56:47 UTC
We are running 24.05 and have found then when we attempt to search the Mana kb for a report, we are getting a 403 Forbidden Error. 

Steps to reproduce:
1. have mana set up
2. Go to reports, create a new report from mana
3. Use a term to search
4. receive a 403 forbidden error.
Comment 1 Phil Ringnalda 2024-07-07 18:50:04 UTC
That's because your search is sending a POST to /cgi-bin/koha/svc/mana/search without a CSRF token.

https://git.koha-community.org/Koha-community/Koha/src/commit/10853d1edc9c31bcef096ffa514bb3025e0a760e/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt#L2394 is implicitly a POST because it passes an object to .load, but before bug 22250 cleaned things up in https://git.koha-community.org/Koha-community/Koha/commit/679fdaebb1a611859a968f22b85c37fbc00b055b it was explicitly a POST (which bizarrely attempted to include a biblionumber, which makes it look like it was originally poorly-chosen copy-paste).

That line should instead be $("#mana_result_content").load("/cgi-bin/koha/svc/mana/search #mana_results", "resource=report&usecomments=1&id=" + textquery, function( response, status, xhr ) {

That nicely returns results from the search, but were the results ever usable? What I get seems to be the result of replacing newlines with '' rather than with ' ' which garbles everything since it does things like "i.ccodeFROM old_reserves oLEFT JOIN items i" and the SQL parser chokes at oLEFT.
Comment 2 Phil Ringnalda 2024-07-07 22:00:33 UTC
Inconveniently placed line wrapping by Bugzilla, but "result of replacing newlines with nothing, rather than with a single space" is Ye Olde bug 24773.
Comment 3 Phil Ringnalda 2024-07-11 12:52:39 UTC
Created attachment 168809 [details] [review]
Bug 37093: Searching for reports on Mana should use GET

Searching for reports on Mana currently fails by sending a POST to
svc/mana/search without a CSRF token. There's no reason to POST, it's
just sending a search string.

 1. Enable Mana: Reports - lower right is a blue Knowledgebase box with
    a link to Change your Mana KB settings
 2. Switch Use Mana KB to Yes, click Save, below that give it a name and
    email, Send to Mana KB
 3. Reports - Use saved - New report - New SQL from Mana
 4. Enter any keyword to search, get a 403 forbidden error
 5. Apply patch, restart_all, Shift+Reload the page to clear cache
 6. Enter any keyword likely to return results, like select, get results
Comment 4 Phil Ringnalda 2024-07-11 12:56:51 UTC
And once I actually read the line about "Your Mana KB server is currently: https://mana-test.koha-community.org" the broken newline conversion could well be only on the test server, dunno.
Comment 5 David Nind 2024-07-31 21:38:11 UTC
Created attachment 169920 [details] [review]
Bug 37093: Searching for reports on Mana should use GET

Searching for reports on Mana currently fails by sending a POST to
svc/mana/search without a CSRF token. There's no reason to POST, it's
just sending a search string.

 1. Enable Mana: Reports - lower right is a blue Knowledgebase box with
    a link to Change your Mana KB settings
 2. Switch Use Mana KB to Yes, click Save, below that give it a name and
    email, Send to Mana KB
 3. Reports - Use saved - New report - New SQL from Mana
 4. Enter any keyword to search, get a 403 forbidden error
 5. Apply patch, restart_all, Shift+Reload the page to clear cache
 6. Enter any keyword likely to return results, like select, get results

Signed-off-by: David Nind <david@davidnind.com>
Comment 6 Victor Grousset/tuxayo 2024-08-01 01:04:10 UTC
Created attachment 169922 [details] [review]
Bug 37093: Searching for reports on Mana should use GET

Searching for reports on Mana currently fails by sending a POST to
svc/mana/search without a CSRF token. There's no reason to POST, it's
just sending a search string.

 1. Enable Mana: Reports - lower right is a blue Knowledgebase box with
    a link to Change your Mana KB settings
 2. Switch Use Mana KB to Yes, click Save, below that give it a name and
    email, Send to Mana KB
 3. Reports - Use saved - New report - New SQL from Mana
 4. Enter any keyword to search, get a 403 forbidden error
 5. Apply patch, restart_all, Shift+Reload the page to clear cache
 6. Enter any keyword likely to return results, like select, get results

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 7 Victor Grousset/tuxayo 2024-08-01 01:04:19 UTC
Works, makes sense, QA script happy, code looks good, passing QA :)
Comment 8 Katrin Fischer 2024-08-01 16:27:13 UTC
Pushed for 24.11!

Well done everyone, thank you!
Comment 9 CJ Lynce 2024-08-02 20:31:54 UTC
Can this be backported to 24.05? We use mana regularly. Thx!
Comment 10 Lucas Gass (lukeg) 2024-08-29 17:15:13 UTC
Backported to 24.05.x for upcoming 24.05.04
Comment 11 Fridolin Somers 2024-09-16 14:08:25 UTC
Not for 23.11.x