Bug 39527

Summary: Cannot create a new notice when running Koha as a Mojolicious application
Product: Koha Reporter: Julian Maurice <julian.maurice>
Component: ToolsAssignee: Julian Maurice <julian.maurice>
Status: Needs Signoff --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low    
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Attachments: Bug 39527: Add action attribute to letter.pl form

Description Julian Maurice 2025-04-02 13:21:13 UTC
When running Koha as a mojolicious application, trying to create a new notice results in a CSRF error, because two different 'op' parameters are sent (one in the URL, one in the POST body)
Comment 1 Julian Maurice 2025-04-02 13:22:03 UTC
Created attachment 180348 [details] [review]
Bug 39527: Add action attribute to letter.pl form

If not explicitly set, two 'op' parameters are sent, one with the value
in the URL (add_form), one with the value in the form
(cud-add_validate).
This causes an error in the CSRF validation code under Mojolicious
environment.

Test plan:
1. Start staff interface as mojolicious application:
   `bin/intranet daemon -l http://*:3000/`
2. Go to http://localhost:3000 (replace localhost by the hostname where
   koha is running), log in, then go to Tools ยป Notices and slips.
3. Create a new notice.
   Without the patch it fails with the following message:
    Incorrect use of an unsafe HTTP method with an `op` parameter that
    does not start with "cud-"
   With the patch it should succeed.