| Summary: | CSRF error when modifying an existing patron record | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Johanna Räisä <johanna.raisa> |
| Component: | Patrons | Assignee: | Owen Leonard <oleonard> |
| Status: | Needs documenting --- | QA Contact: | Emily Lamancusa (emlam) <emily.lamancusa> |
| Severity: | major | ||
| Priority: | P1 - high | CC: | emily.lamancusa, fridolin.somers, gmcharlt, kyle.m.hall, lucas |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
24.11.00,24.05.04
|
|
| Circulation function: | |||
| Attachments: |
Bug 37523: CSRF error when modifying an existing patron record
Bug 37523: CSRF error when modifying an existing patron record Bug 37523: CSRF error when modifying an existing patron record Bug 37523: CSRF error when modifying an existing patron record |
||
|
Description
Johanna Räisä
2024-07-30 11:43:11 UTC
Created attachment 169857 [details] [review] Bug 37523: CSRF error when modifying an existing patron record This patch modifies the patron entry template to avoid a CSRF error when clicking the "Edit existing record" button after a duplicate patron is found. The operation should be GET and thus can be a link. To test, apply the patch and go to Patrons. - If you aren't using the default testing data you should first locate an existing patron record so you can refer to the details. - Start the process of creating a new patron record. - Use the existing patron's data to fill out the form. - With the default data you can use: - Surname: Bennett - First name: Pamela - Date of birth: 09/16/1946 - Any random new card number - When you click "Save" you should get a duplicate patron warning: "Duplicate patron record?" - Click "It is a duplicate. Edit existing record." - You should be taken to the edit form for the existing patron. Sponsored-by: Athens County Public Libraries Created attachment 169867 [details] [review] Bug 37523: CSRF error when modifying an existing patron record This patch modifies the patron entry template to avoid a CSRF error when clicking the "Edit existing record" button after a duplicate patron is found. The operation should be GET and thus can be a link. To test, apply the patch and go to Patrons. - If you aren't using the default testing data you should first locate an existing patron record so you can refer to the details. - Start the process of creating a new patron record. - Use the existing patron's data to fill out the form. - With the default data you can use: - Surname: Bennett - First name: Pamela - Date of birth: 09/16/1946 - Any random new card number - When you click "Save" you should get a duplicate patron warning: "Duplicate patron record?" - Click "It is a duplicate. Edit existing record." - You should be taken to the edit form for the existing patron. Sponsored-by: Athens County Public Libraries Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> Created attachment 169880 [details] [review] Bug 37523: CSRF error when modifying an existing patron record This patch modifies the patron entry template to avoid a CSRF error when clicking the "Edit existing record" button after a duplicate patron is found. The operation should be GET and thus can be a link. To test, apply the patch and go to Patrons. - If you aren't using the default testing data you should first locate an existing patron record so you can refer to the details. - Start the process of creating a new patron record. - Use the existing patron's data to fill out the form. - With the default data you can use: - Surname: Bennett - First name: Pamela - Date of birth: 09/16/1946 - Any random new card number - When you click "Save" you should get a duplicate patron warning: "Duplicate patron record?" - Click "It is a duplicate. Edit existing record." - You should be taken to the edit form for the existing patron. Sponsored-by: Athens County Public Libraries Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> Signed-off-by: Johanna Räisä <johanna.raisa@gmail.com> Created attachment 169916 [details] [review] Bug 37523: CSRF error when modifying an existing patron record This patch modifies the patron entry template to avoid a CSRF error when clicking the "Edit existing record" button after a duplicate patron is found. The operation should be GET and thus can be a link. To test, apply the patch and go to Patrons. - If you aren't using the default testing data you should first locate an existing patron record so you can refer to the details. - Start the process of creating a new patron record. - Use the existing patron's data to fill out the form. - With the default data you can use: - Surname: Bennett - First name: Pamela - Date of birth: 09/16/1946 - Any random new card number - When you click "Save" you should get a duplicate patron warning: "Duplicate patron record?" - Click "It is a duplicate. Edit existing record." - You should be taken to the edit form for the existing patron. Sponsored-by: Athens County Public Libraries Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> Signed-off-by: Johanna Räisä <johanna.raisa@gmail.com> Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> This works and QA tool passes. This really doesn't need to be a form submission; the direct link works fine, so the new coding guideline (JS16) doesn't apply here. Passing QA. Pushed for 24.11! Well done everyone, thank you! Backported to 24.05.x for upcoming 24.05.04 Not for 23.11.x |