| Summary: | Unable to delete patron card creator images | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Laura Escamilla <Laura.escamilla> |
| Component: | Tools | Assignee: | David Cook <dcook> |
| Status: | Needs documenting --- | QA Contact: | Martin Renvoize (ashimema) <martin.renvoize> |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | david, dcook, fridolin.somers, jonathan.druart, lucas, martin.renvoize, phil |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38277 | ||
| Change sponsored?: | --- | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: |
This fixes deleting images when using the patron card creator's image manager. You could not delete images, and received an error message "WARNING: An unsupported operation was attempted. Please have your system administrator check the error log for details." (This is related to the CSRF changes added in Koha 24.05 to improve form security.)
|
Version(s) released in: |
24.11.00,24.05.06
|
| Circulation function: | |||
| Bug Depends on: | 36192 | ||
| Bug Blocks: | |||
| Attachments: |
Bug 38275: Remove "cud" from delete
Bug 38275: Ensure that the script block is loaded after the HTML elements are available. Bug 38275: Remove "cud" from delete Bug 38275: Ensure that the script block is loaded after the HTML elements are available. Bug 38275: Fix patron card creator image delete Bug 38275: Fix patron card creator image delete Bug 38275: Fix patron card creator image delete |
||
|
Description
Laura Escamilla
2024-10-25 14:34:50 UTC
Created attachment 173397 [details] [review] Bug 38275: Remove "cud" from delete To test: 1. Go to Tools > Patron Card Creator > New Image (or Manage Images) 2. Upload a photo to the image manager if one does not already exist 3. On the table labeled "Delete Images" attempt to delete the image using the "Delete" button, or try using the checkbox and "Delete selected" button. Neither method deletes the image. Instead you get the following error: "WARNING: An unsupported operation was attempted. Please have your system administrator check the error log for details." 4. Apply patch and restart_all 5. Upload more images to the image manager 6. Delete one image using the “Delete button”. The deletion is successful. 7. Use the checkboxes to select the remaining images that you want to delete. Click on “Delete selected” at the bottom of the table. All selected images are now deleted. 8. Sign off and have an amazing day! :D Created attachment 173398 [details] [review] Bug 38275: Ensure that the script block is loaded after the HTML elements are available. Created attachment 173407 [details] [review] Bug 38275: Remove "cud" from delete Signed-off-by: David Nind <david@davidnind.com> Created attachment 173408 [details] [review] Bug 38275: Ensure that the script block is loaded after the HTML elements are available. Signed-off-by: David Nind <david@davidnind.com> That's one messed-up CSRF-protection avoiding page: it has a form, with method="post" and op="cud-delete" just like anything doing a delete should, but then the submit button doesn't submit the form, it just concatenates the selected_images together and sticks them on a GET of ?op=delete. (In reply to Phil Ringnalda from comment #5) > That's one messed-up CSRF-protection avoiding page: it has a form, with > method="post" and op="cud-delete" just like anything doing a delete should, > but then the submit button doesn't submit the form, it just concatenates the > selected_images together and sticks them on a GET of ?op=delete. Good spotting, Phil. In this case, you should mark this bug as Failed QA. (Note: anyone can mark a bug as Failed QA.) Created attachment 173419 [details] [review] Bug 38275: Fix patron card creator image delete This change changes the patron card creator image delete from a GET to a POST, and supports single delete and multi-delete. Test plan: 1. Apply the patch (and refresh browser JS cache) 2. Go to http://localhost:8081/cgi-bin/koha/patroncards/image-manage.pl 3. Upload multiple images 4. Select all the images using the checkboxes 5. Delete one image using the "Delete" button in the row 6. Note that only the image selected using the "Delete" button is deleted and the other images are de-selected 7. Delete multiple images using the "Delete selected" button 8. Note that the correct images are noted in the confirm message, and the correct images are deleted (In reply to Phil Ringnalda from comment #5) > That's one messed-up CSRF-protection avoiding page: it has a form, with > method="post" and op="cud-delete" just like anything doing a delete should, > but then the submit button doesn't submit the form, it just concatenates the > selected_images together and sticks them on a GET of ?op=delete. Apologies for taking this one over. As Phil notes, this stateful (CUD) operation needs to be done with a POST. I used Phil's idea of leveraging the existing POST form. Created attachment 173420 [details] [review] Bug 38275: Fix patron card creator image delete This change changes the patron card creator image delete from a GET to a POST, and supports single delete and multi-delete. Test plan: 1. Apply the patch (and refresh browser JS cache) 2. Go to http://localhost:8081/cgi-bin/koha/patroncards/image-manage.pl 3. Upload multiple images 4. Select all the images using the checkboxes 5. Delete one image using the "Delete" button in the row 6. Note that only the image selected using the "Delete" button is deleted and the other images are de-selected 7. Delete multiple images using the "Delete selected" button 8. Note that the correct images are noted in the confirm message, and the correct images are deleted Signed-off-by: David Nind <david@davidnind.com> Created attachment 173434 [details] [review] Bug 38275: Fix patron card creator image delete This change changes the patron card creator image delete from a GET to a POST, and supports single delete and multi-delete. Test plan: 1. Apply the patch (and refresh browser JS cache) 2. Go to http://localhost:8081/cgi-bin/koha/patroncards/image-manage.pl 3. Upload multiple images 4. Select all the images using the checkboxes 5. Delete one image using the "Delete" button in the row 6. Note that only the image selected using the "Delete" button is deleted and the other images are de-selected 7. Delete multiple images using the "Delete selected" button 8. Note that the correct images are noted in the confirm message, and the correct images are deleted Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Pushed for 24.11! Well done everyone, thank you! Backported to 24.05.x for upcoming 24.05.06 Not for 23.11.x |