| Summary: | stocknumberAV.pl fails with CSRF protection | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Janusz Kaczmarek <januszop> |
| Component: | Cataloging | Assignee: | Janusz Kaczmarek <januszop> |
| Status: | Needs documenting --- | QA Contact: | David Cook <dcook> |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | dcook, fridolin.somers, lucas, m.de.rooy, pmis |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38065 | ||
| Change sponsored?: | Sponsored | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
24.11.00,24.05.06
|
|
| Circulation function: | |||
| Bug Depends on: | |||
| Bug Blocks: | 36192 | ||
| Attachments: |
Bug 38030: stocknumberAV.pl fails with CSRF protection
Bug 38030: stocknumberAV.pl fails with CSRF protection Bug 38030: stocknumberAV.pl fails with CSRF protection Bug 38030: (QA follow-up) Move csrf_token to POST body from URL |
||
|
Description
Janusz Kaczmarek
2024-09-30 09:20:10 UTC
Created attachment 172216 [details] [review] Bug 38030: stocknumberAV.pl fails with CSRF protection The value builder stocknumberAV.pl does not work after applying the CSRF protection. In console, it generates entries like: POST http://localhost:8081/cgi-bin/koha/cataloguing/plugin_launcher.pl [HTTP/1.1 403 Forbidden 188ms] Test plan: ========== 1. Modify the MARC bibliographic framework for the default framework by choosing stocknumberAV.pl as plugin for subfield 952 $i. 2. In Authorized values, add a new category 'INVENTORY'. Add a new entry there, e.g. 'ABC', with any number in Description (eg. 123). 3. Find any bibliographic record, make sure it uses the default framework. If not set the framework accordingly. 4. Edit an item linked to this record. Go to the 'i - Inventory number' subfield. You should see three dots on the right. In the input field put ABC and click the three dots. 5. Nothing happens. You can check in the browser console--there should be a message like: POST http://FQDN:8081/cgi-bin/koha/cataloguing/plugin_launcher.pl [HTTP/1.1 403 Forbidden 188ms] 6. Apply the patch; restart_all. Refresh the browser window. 7. Repeat p. 4. You should now get the next sequence number next to the 'ABC' (i.e. ABC 0000000124 or similar). Sponsored-by: Ignatianum University in Cracow Created attachment 172238 [details] [review] Bug 38030: stocknumberAV.pl fails with CSRF protection The value builder stocknumberAV.pl does not work after applying the CSRF protection. In console, it generates entries like: POST http://localhost:8081/cgi-bin/koha/cataloguing/plugin_launcher.pl [HTTP/1.1 403 Forbidden 188ms] Test plan: ========== 1. Modify the MARC bibliographic framework for the default framework by choosing stocknumberAV.pl as plugin for subfield 952 $i. 2. In Authorized values, add a new category 'INVENTORY'. Add a new entry there, e.g. 'ABC', with any number in Description (eg. 123). 3. Find any bibliographic record, make sure it uses the default framework. If not set the framework accordingly. 4. Edit an item linked to this record. Go to the 'i - Inventory number' subfield. You should see three dots on the right. In the input field put ABC and click the three dots. 5. Nothing happens. You can check in the browser console--there should be a message like: POST http://FQDN:8081/cgi-bin/koha/cataloguing/plugin_launcher.pl [HTTP/1.1 403 Forbidden 188ms] 6. Apply the patch; restart_all. Refresh the browser window. 7. Repeat p. 4. You should now get the next sequence number next to the 'ABC' (i.e. ABC 0000000124 or similar). Sponsored-by: Ignatianum University in Cracow Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> The csrf_token needs to go in the body of the POST and not in the URL. If it can't go in the body, then it can go in as a HTTP header. (In reply to David Cook from comment #3) > The csrf_token needs to go in the body of the POST and not in the URL. > > If it can't go in the body, then it can go in as a HTTP header. Why are we POSTing here ? This particular plugin is changing the content of the database (updating a row in the authorised_values table), if I remember right, so it's OK to POST, IMO. Created attachment 173086 [details] [review] Bug 38030: stocknumberAV.pl fails with CSRF protection The value builder stocknumberAV.pl does not work after applying the CSRF protection. In console, it generates entries like: POST http://localhost:8081/cgi-bin/koha/cataloguing/plugin_launcher.pl [HTTP/1.1 403 Forbidden 188ms] Test plan: ========== 1. Modify the MARC bibliographic framework for the default framework by choosing stocknumberAV.pl as plugin for subfield 952 $i. 2. In Authorized values, add a new category 'INVENTORY'. Add a new entry there, e.g. 'ABC', with any number in Description (eg. 123). 3. Find any bibliographic record, make sure it uses the default framework. If not set the framework accordingly. 4. Edit an item linked to this record. Go to the 'i - Inventory number' subfield. You should see three dots on the right. In the input field put ABC and click the three dots. 5. Nothing happens. You can check in the browser console--there should be a message like: POST http://FQDN:8081/cgi-bin/koha/cataloguing/plugin_launcher.pl [HTTP/1.1 403 Forbidden 188ms] 6. Apply the patch; restart_all. Refresh the browser window. 7. Repeat p. 4. You should now get the next sequence number next to the 'ABC' (i.e. ABC 0000000124 or similar). Sponsored-by: Ignatianum University in Cracow Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> Signed-off-by: David Cook <dcook@prosentient.com.au> Created attachment 173087 [details] [review] Bug 38030: (QA follow-up) Move csrf_token to POST body from URL Signed-off-by: David Cook <dcook@prosentient.com.au> (In reply to Janusz Kaczmarek from comment #5) > This particular plugin is changing the content of the database (updating a > row in the authorised_values table), if I remember right, so it's OK to > POST, IMO. That's true Pushed for 24.11! Well done everyone, thank you! I don't see the follow up commit in main. Am I missing something? (In reply to Lucas Gass (lukeg) from comment #10) > I don't see the follow up commit in main. Am I missing something? Indeed. Me neither. @Katrin, would you be able to double check it? Picked the follow-up for main. Thanks! Backported to 24.05.x for upcoming 24.05.06 Not for 23.11.x |