Summary: | Printing patron cards from patron lists broken by CSRF protection | ||
---|---|---|---|
Product: | Koha | Reporter: | Phil Ringnalda <phil> |
Component: | Tools | Assignee: | Phil Ringnalda <phil> |
Status: | RESOLVED FIXED | QA Contact: | Marcel de Rooy <m.de.rooy> |
Severity: | major | ||
Priority: | P5 - low | CC: | david, fridolin.somers, jonathan.druart, lucas, m.de.rooy, oleonard |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37612 | ||
Change sponsored?: | --- | Patch complexity: | Trivial patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: |
This fixes printing patron cards from a patron list (Tools > Patrons and circulation > Patron lists > Actions > Print patron cards > Export). When clicking on Export, the progress icon keeps spinning and doesn't finish - resulting in no PDF file to download. (This is related to the CSRF changes added in Koha 24.05 to improve form security.)
|
Version(s) released in: |
24.11.00,24.05.04
|
Circulation function: | |||
Bug Depends on: | |||
Bug Blocks: | 36192 | ||
Attachments: |
Bug 37614: Printing patron cards from patron lists should be a GET
Bug 37614: Printing patron cards from patron lists should be a GET Bug 37614: Printing patron cards from patron lists should be a GET |
Description
Phil Ringnalda
2024-08-09 20:33:05 UTC
Oh, it's a GET because the entire popup <div> (where I never would have looked for a handler) has an onsubmit handler which cancels the submit, drags the fields out of the form, stuffs them in a query string, and GETs the .action URL with it. https://git.koha-community.org/Koha-community/Koha/src/commit/52dccfe27beec80003a86f3f73257b87f0118eeb/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/lists.tt#L204 That's... something. Created attachment 170416 [details] [review] Bug 37614: Printing patron cards from patron lists should be a GET There's no creating, updating, or deleting about printing patron cards, and the only time there's a lot of data (selecting individual patrons in a card creator batch), it doesn't matter if the "Export selected" URL exceeds the maxlength for Apache since the actual link to create the PDF also will. Test plan: 1. Without the patch, Tools - Patron lists - New patron list - Name it and Save 2. Type three characters in the Patron search form (mar works well) to get at least three patrons. Click on each of three, then click Add patrons 3. You can only print cards from the list of lists, so back to Tools - Patron lists 4. In the Actions menu choose Print patron cards, in the popup click Export 5. Watch the throbber spin around for a while (it will never stop), then close the popup, apply the patch, restart_all 6. Tools - Patron lists - Actions menu - Print patron cards - Export 7. Click the PDF link, make sure it has all three of your patrons 8. Tools - Patron card creator - New - Card batch 9. Without putting anything in the textarea, click Add patrons, in the search popup search for your three characters (mar) again, and click the checkboxes to the left of three of the names, then Add selected patrons, then Close, then Add patrons 10. Click the checkboxes for two of the three patrons, then Export selected card(s), then Export in the popup 11. Hover the link to the PDF, verify that it doesn't have stray 'amp;' after the & and before label_id= anymore 12. Click the PDF link, verify it has your two patrons 13. Back at the card batch, click Export card batch, then Export 14. Check the PDF to verify it has all three of your patrons 15. Tools - Patron lists - click your list's name to open it 16. Click the card number for a patron, then the Patron lists tab in Checkout 17. Actions menu - Print patron cards - Export, verify the PDF has all three patrons Created attachment 170417 [details] [review] Bug 37614: Printing patron cards from patron lists should be a GET There's no creating, updating, or deleting about printing patron cards, and the only time there's a lot of data (selecting individual patrons in a card creator batch), it doesn't matter if the "Export selected" URL exceeds the maxlength for Apache since the actual link to create the PDF also will. Test plan: 1. Without the patch, Tools - Patron lists - New patron list - Name it and Save 2. Type three characters in the Patron search form (mar works well) to get at least three patrons. Click on each of three, then click Add patrons 3. You can only print cards from the list of lists, so back to Tools - Patron lists 4. In the Actions menu choose Print patron cards, in the popup click Export 5. Watch the throbber spin around for a while (it will never stop), then close the popup, apply the patch, restart_all 6. Tools - Patron lists - Actions menu - Print patron cards - Export 7. Click the PDF link, make sure it has all three of your patrons 8. Tools - Patron card creator - New - Card batch 9. Without putting anything in the textarea, click Add patrons, in the search popup search for your three characters (mar) again, and click the checkboxes to the left of three of the names, then Add selected patrons, then Close, then Add patrons 10. Click the checkboxes for two of the three patrons, then Export selected card(s), then Export in the popup 11. Hover the link to the PDF, verify that it doesn't have stray 'amp;' after the & and before label_id= anymore 12. Click the PDF link, verify it has your two patrons 13. Back at the card batch, click Export card batch, then Export 14. Check the PDF to verify it has all three of your patrons 15. Tools - Patron lists - click your list's name to open it 16. Click the card number for a patron, then the Patron lists tab in Checkout 17. Actions menu - Print patron cards - Export, verify the PDF has all three patrons Signed-off-by: David Nind <david@davidnind.com> I've signed off, however I think step 17 needs fixing. With the patch applied, when you select Actions > Print patron cards, the export page and results from selecting 'Export' are not in a pop-up window. This is how it works on main as well. However, I think this needs fixing - maybe as a separate bug if you don't want to fix it here? Very much a separate bug, thanks. I'd like to let someone who thinks it's a good idea to have UI to print a whole batch of patron cards while checking out to one patron in the list decide what that UI should look like. Created attachment 170422 [details] [review] Bug 37614: Printing patron cards from patron lists should be a GET There's no creating, updating, or deleting about printing patron cards, and the only time there's a lot of data (selecting individual patrons in a card creator batch), it doesn't matter if the "Export selected" URL exceeds the maxlength for Apache since the actual link to create the PDF also will. Test plan: 1. Without the patch, Tools - Patron lists - New patron list - Name it and Save 2. Type three characters in the Patron search form (mar works well) to get at least three patrons. Click on each of three, then click Add patrons 3. You can only print cards from the list of lists, so back to Tools - Patron lists 4. In the Actions menu choose Print patron cards, in the popup click Export 5. Watch the throbber spin around for a while (it will never stop), then close the popup, apply the patch, restart_all 6. Tools - Patron lists - Actions menu - Print patron cards - Export 7. Click the PDF link, make sure it has all three of your patrons 8. Tools - Patron card creator - New - Card batch 9. Without putting anything in the textarea, click Add patrons, in the search popup search for your three characters (mar) again, and click the checkboxes to the left of three of the names, then Add selected patrons, then Close, then Add patrons 10. Click the checkboxes for two of the three patrons, then Export selected card(s), then Export in the popup 11. Hover the link to the PDF, verify that it doesn't have stray 'amp;' after the & and before label_id= anymore 12. Click the PDF link, verify it has your two patrons 13. Back at the card batch, click Export card batch, then Export 14. Check the PDF to verify it has all three of your patrons 15. Tools - Patron lists - click your list's name to open it 16. Click the card number for a patron, then the Patron lists tab in Checkout 17. Actions menu - Print patron cards - Export, verify the PDF has all three patrons Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Pushed for 24.11! Well done everyone, thank you! Backported to 24.05.x for upcoming 24.05.04 Not for 23.11.x |