Summary: | Unnecessary CSRF token in OPAC authority search | ||
---|---|---|---|
Product: | Koha | Reporter: | Phil Ringnalda <phil> |
Component: | OPAC | Assignee: | Phil Ringnalda <phil> |
Status: | RESOLVED FIXED | QA Contact: | Emily Lamancusa (emlam) <emily.lamancusa> |
Severity: | minor | ||
Priority: | P5 - low | CC: | david, emily.lamancusa, fridolin.somers, lucas |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | --- | Documentation contact: | |
Documentation submission: | Text to go in the release notes: |
This fixes the OPAC authority search result URL so that it no longer includes the CSRF token, and makes the URL more readable. (This is related to the CSRF changes added in Koha 24.05 to improve form security.)
|
|
Version(s) released in: |
24.11.00,24.05.06
|
Circulation function: | |
Bug Depends on: | 36192, 37069 | ||
Bug Blocks: | |||
Attachments: |
Bug 38463: Unnecessary CSRF token in OPAC authority search
Bug 38463: Unnecessary CSRF token in OPAC authority search Bug 38463: Unnecessary CSRF token in OPAC authority search |
Description
Phil Ringnalda
2024-11-15 22:05:12 UTC
Created attachment 174635 [details] [review] Bug 38463: Unnecessary CSRF token in OPAC authority search Bug 37069 correctly changed OPAC authority searches from a POST to a GET, but forgot to remove the CSRF token that is only needed for a POST, so now it clutters up the URL by making the first 107 characters of the query string meaningless. Test plan: 1. Without the patch, in the OPAC, go to Authority search 2. Change the dropdowns to non-default values so you have meaningful search conditions, and search for something that will return results, like Topical Term/starts with/a/in any heading/Heading descendant 3. Copy the URL of your search results, paste it in an email compose window, look at what you just pasted and wonder whether that big opaque string is actually safe to send to a coworker. Go to lunch. Come back and wonder what you searched for, and look at the URL in the browser to try to tell 4. Apply patch, click the browser back button, reload the page, search again 5. Copy and paste the URL, notice it looks fine to send, just a search. Look at the URL in the browser address bar, notice that within the limits of your window size, you can see what you searched for Sponsored-by: Chetco Community Public Library Created attachment 174637 [details] [review] Bug 38463: Unnecessary CSRF token in OPAC authority search Bug 37069 correctly changed OPAC authority searches from a POST to a GET, but forgot to remove the CSRF token that is only needed for a POST, so now it clutters up the URL by making the first 107 characters of the query string meaningless. Test plan: 1. Without the patch, in the OPAC, go to Authority search 2. Change the dropdowns to non-default values so you have meaningful search conditions, and search for something that will return results, like Topical Term/starts with/a/in any heading/Heading descendant 3. Copy the URL of your search results, paste it in an email compose window, look at what you just pasted and wonder whether that big opaque string is actually safe to send to a coworker. Go to lunch. Come back and wonder what you searched for, and look at the URL in the browser to try to tell 4. Apply patch, click the browser back button, reload the page, search again 5. Copy and paste the URL, notice it looks fine to send, just a search. Look at the URL in the browser address bar, notice that within the limits of your window size, you can see what you searched for Sponsored-by: Chetco Community Public Library Signed-off-by: David Nind <david@davidnind.com> Created attachment 174759 [details] [review] Bug 38463: Unnecessary CSRF token in OPAC authority search Bug 37069 correctly changed OPAC authority searches from a POST to a GET, but forgot to remove the CSRF token that is only needed for a POST, so now it clutters up the URL by making the first 107 characters of the query string meaningless. Test plan: 1. Without the patch, in the OPAC, go to Authority search 2. Change the dropdowns to non-default values so you have meaningful search conditions, and search for something that will return results, like Topical Term/starts with/a/in any heading/Heading descendant 3. Copy the URL of your search results, paste it in an email compose window, look at what you just pasted and wonder whether that big opaque string is actually safe to send to a coworker. Go to lunch. Come back and wonder what you searched for, and look at the URL in the browser to try to tell 4. Apply patch, click the browser back button, reload the page, search again 5. Copy and paste the URL, notice it looks fine to send, just a search. Look at the URL in the browser address bar, notice that within the limits of your window size, you can see what you searched for Sponsored-by: Chetco Community Public Library Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> Good catch, thanks Phil! Passing QA Pushed for 24.11! Well done everyone, thank you! Backported to 24.05.x for upcoming 24.05.06 Not for 23.11.x This is a bug fix and there are no interface changes, no updates to the manual required. |