| Summary: | Cannot create a new notice when running Koha as a Mojolicious application | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Julian Maurice <julian.maurice> |
| Component: | Tools | Assignee: | Julian Maurice <julian.maurice> |
| Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | magnus, martin.renvoize |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Attachments: |
Bug 39527: Add action attribute to letter.pl form
Bug 39527: Add action attribute to letter.pl form |
||
|
Description
Julian Maurice
2025-04-02 13:21:13 UTC
Created attachment 180348 [details] [review] Bug 39527: Add action attribute to letter.pl form If not explicitly set, two 'op' parameters are sent, one with the value in the URL (add_form), one with the value in the form (cud-add_validate). This causes an error in the CSRF validation code under Mojolicious environment. Test plan: 1. Start staff interface as mojolicious application: `bin/intranet daemon -l http://*:3000/` 2. Go to http://localhost:3000 (replace localhost by the hostname where koha is running), log in, then go to Tools » Notices and slips. 3. Create a new notice. Without the patch it fails with the following message: Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-" With the patch it should succeed. Created attachment 180667 [details] [review] Bug 39527: Add action attribute to letter.pl form If not explicitly set, two 'op' parameters are sent, one with the value in the URL (add_form), one with the value in the form (cud-add_validate). This causes an error in the CSRF validation code under Mojolicious environment. Test plan: 1. Start staff interface as mojolicious application: `bin/intranet daemon -l http://*:3000/` 2. Go to http://localhost:3000 (replace localhost by the hostname where koha is running), log in, then go to Tools » Notices and slips. 3. Create a new notice. Without the patch it fails with the following message: Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-" With the patch it should succeed. Signed-off-by: Magnus Enger <magnus@libriotech.no> To test in KTD I did this: $ sudo koha-plack --stop kohadev $ sudo service apache2 stop $ bin/intranet daemon -l http://*:8081/ |