Bug 38463

Summary: Unnecessary CSRF token in OPAC authority search
Product: Koha Reporter: Phil Ringnalda <phil>
Component: OPACAssignee: Phil Ringnalda <phil>
Status: RESOLVED FIXED QA Contact: Emily Lamancusa (emlam) <emily.lamancusa>
Severity: minor    
Priority: P5 - low CC: david, emily.lamancusa, fridolin.somers, lucas
Version: Main   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
This fixes the OPAC authority search result URL so that it no longer includes the CSRF token, and makes the URL more readable. (This is related to the CSRF changes added in Koha 24.05 to improve form security.)
Version(s) released in:
24.11.00,24.05.06
Circulation function:
Bug Depends on: 36192, 37069    
Bug Blocks:    
Attachments: Bug 38463: Unnecessary CSRF token in OPAC authority search
Bug 38463: Unnecessary CSRF token in OPAC authority search
Bug 38463: Unnecessary CSRF token in OPAC authority search

Description Phil Ringnalda 2024-11-15 22:05:12 UTC
Bug 37069 correctly changed OPAC authority searches from a POST to a GET, but forgot to remove the CSRF token that is only needed for a POST, so now it clutters up the URL by making the first 107 characters of the query string meaningless.
Comment 1 Phil Ringnalda 2024-11-15 22:24:18 UTC
Created attachment 174635 [details] [review]
Bug 38463: Unnecessary CSRF token in OPAC authority search

Bug 37069 correctly changed OPAC authority searches from a POST to a GET, but
forgot to remove the CSRF token that is only needed for a POST, so now it
clutters up the URL by making the first 107 characters of the query string
meaningless.

Test plan:
 1. Without the patch, in the OPAC, go to Authority search
 2. Change the dropdowns to non-default values so you have meaningful search
    conditions, and search for something that will return results, like
    Topical Term/starts with/a/in any heading/Heading descendant
 3. Copy the URL of your search results, paste it in an email compose window,
    look at what you just pasted and wonder whether that big opaque string is
    actually safe to send to a coworker. Go to lunch. Come back and wonder
    what you searched for, and look at the URL in the browser to try to tell
 4. Apply patch, click the browser back button, reload the page, search again
 5. Copy and paste the URL, notice it looks fine to send, just a search. Look
    at the URL in the browser address bar, notice that within the limits of
    your window size, you can see what you searched for

Sponsored-by: Chetco Community Public Library
Comment 2 David Nind 2024-11-15 22:46:30 UTC
Created attachment 174637 [details] [review]
Bug 38463: Unnecessary CSRF token in OPAC authority search

Bug 37069 correctly changed OPAC authority searches from a POST to a GET, but
forgot to remove the CSRF token that is only needed for a POST, so now it
clutters up the URL by making the first 107 characters of the query string
meaningless.

Test plan:
 1. Without the patch, in the OPAC, go to Authority search
 2. Change the dropdowns to non-default values so you have meaningful search
    conditions, and search for something that will return results, like
    Topical Term/starts with/a/in any heading/Heading descendant
 3. Copy the URL of your search results, paste it in an email compose window,
    look at what you just pasted and wonder whether that big opaque string is
    actually safe to send to a coworker. Go to lunch. Come back and wonder
    what you searched for, and look at the URL in the browser to try to tell
 4. Apply patch, click the browser back button, reload the page, search again
 5. Copy and paste the URL, notice it looks fine to send, just a search. Look
    at the URL in the browser address bar, notice that within the limits of
    your window size, you can see what you searched for

Sponsored-by: Chetco Community Public Library
Signed-off-by: David Nind <david@davidnind.com>
Comment 3 Emily Lamancusa (emlam) 2024-11-18 20:45:58 UTC
Created attachment 174759 [details] [review]
Bug 38463: Unnecessary CSRF token in OPAC authority search

Bug 37069 correctly changed OPAC authority searches from a POST to a GET, but
forgot to remove the CSRF token that is only needed for a POST, so now it
clutters up the URL by making the first 107 characters of the query string
meaningless.

Test plan:
 1. Without the patch, in the OPAC, go to Authority search
 2. Change the dropdowns to non-default values so you have meaningful search
    conditions, and search for something that will return results, like
    Topical Term/starts with/a/in any heading/Heading descendant
 3. Copy the URL of your search results, paste it in an email compose window,
    look at what you just pasted and wonder whether that big opaque string is
    actually safe to send to a coworker. Go to lunch. Come back and wonder
    what you searched for, and look at the URL in the browser to try to tell
 4. Apply patch, click the browser back button, reload the page, search again
 5. Copy and paste the URL, notice it looks fine to send, just a search. Look
    at the URL in the browser address bar, notice that within the limits of
    your window size, you can see what you searched for

Sponsored-by: Chetco Community Public Library
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Comment 4 Emily Lamancusa (emlam) 2024-11-18 20:46:46 UTC
Good catch, thanks Phil! Passing QA
Comment 5 Katrin Fischer 2024-11-19 15:36:55 UTC
Pushed for 24.11!

Well done everyone, thank you!
Comment 6 Lucas Gass (lukeg) 2024-12-05 22:40:44 UTC
Backported to 24.05.x for upcoming 24.05.06
Comment 7 Fridolin Somers 2024-12-18 13:23:09 UTC
Not for 23.11.x
Comment 8 David Nind 2024-12-18 19:22:36 UTC
This is a bug fix and there are no interface changes, no updates to the manual required.