Summary: | Cannot delete image from patron card creator | ||
---|---|---|---|
Product: | Koha | Reporter: | Caroline Cyr La Rose <caroline.cyr-la-rose> |
Component: | Label/patron card printing | Assignee: | Owen Leonard <oleonard> |
Status: | Pushed to stable --- | QA Contact: | Marcel de Rooy <m.de.rooy> |
Severity: | normal | ||
Priority: | P5 - low | CC: | m.de.rooy |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | Small patch | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: |
25.11.00,25.05.01
|
Circulation function: | |
Attachments: |
Bug 40061: Add CSRF protection to patron image deletion
Bug 40061: (follow-up) Delete last image using checkbox Bug 40061: Add CSRF protection to patron image deletion Bug 40061: (follow-up) Delete last image using checkbox Bug 40061: Add CSRF protection to patron image deletion Bug 40061: (follow-up) Delete last image using checkbox |
Description
Caroline Cyr La Rose
2025-06-03 16:41:25 UTC
Created attachment 182946 [details] [review] Bug 40061: Add CSRF protection to patron image deletion The patron image deletion operation was not fully updated in Bug 34478. The individual "Delete" buttons in the table of images need to be updated to use form-submit.js Unrelated: I removed an invalid "align" attribute from a <td>. To test, apply the patch and go to Tools -> Patron card creator -> Image manager. - Upload multiple images - Test the individual "Delete" buttons in the table of images. - Test that both the "OK" and "Cancel" operations work correctly. - Test the process of checking one or more checkboxes and clicking the "Delete selected" button. - Test that both the "OK" and "Cancel" operations work correctly. Sponsored-by: Athens County Public Libraries Thanks Owen! The Delete button works now. I know it wasn't part of the original bug report, but I also tested the checkbox + Delete selected button, and for some reason, when I try to delete the last image this way, it's not deleted...? If there is one image, and you check it and click Delete selected, it's not deleted. If there is more than one and you check one or more, they are deleted. Is it the same problem? Created attachment 182957 [details] [review] Bug 40061: (follow-up) Delete last image using checkbox This followup corrects a problem in image deletion which isn't really the same issue (it's not CSRF related) but is another problem with deletion. The JS for grabbing all the checkboxes by name wasn't working when there is only one checkbox. To test, apply the patch and delete all but one image from the patron card creator image manager. - Check the checkbox for the last image and click the "Delete selected" button. - The image should be deleted successfully. Sponsored-by: Athens County Public Libraries (In reply to Caroline Cyr La Rose from comment #2) > Is it the same problem? Technically not the same problem but it makes sense to me to include the fix here. Created attachment 182959 [details] [review] Bug 40061: Add CSRF protection to patron image deletion The patron image deletion operation was not fully updated in Bug 34478. The individual "Delete" buttons in the table of images need to be updated to use form-submit.js Unrelated: I removed an invalid "align" attribute from a <td>. To test, apply the patch and go to Tools -> Patron card creator -> Image manager. - Upload multiple images - Test the individual "Delete" buttons in the table of images. - Test that both the "OK" and "Cancel" operations work correctly. - Test the process of checking one or more checkboxes and clicking the "Delete selected" button. - Test that both the "OK" and "Cancel" operations work correctly. Sponsored-by: Athens County Public Libraries Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> Created attachment 182960 [details] [review] Bug 40061: (follow-up) Delete last image using checkbox This followup corrects a problem in image deletion which isn't really the same issue (it's not CSRF related) but is another problem with deletion. The JS for grabbing all the checkboxes by name wasn't working when there is only one checkbox. To test, apply the patch and delete all but one image from the patron card creator image manager. - Check the checkbox for the last image and click the "Delete selected" button. - The image should be deleted successfully. Sponsored-by: Athens County Public Libraries Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> Perfect! Thank you! Created attachment 183039 [details] [review] Bug 40061: Add CSRF protection to patron image deletion The patron image deletion operation was not fully updated in Bug 34478. The individual "Delete" buttons in the table of images need to be updated to use form-submit.js Unrelated: I removed an invalid "align" attribute from a <td>. To test, apply the patch and go to Tools -> Patron card creator -> Image manager. - Upload multiple images - Test the individual "Delete" buttons in the table of images. - Test that both the "OK" and "Cancel" operations work correctly. - Test the process of checking one or more checkboxes and clicking the "Delete selected" button. - Test that both the "OK" and "Cancel" operations work correctly. Sponsored-by: Athens County Public Libraries Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Created attachment 183040 [details] [review] Bug 40061: (follow-up) Delete last image using checkbox This followup corrects a problem in image deletion which isn't really the same issue (it's not CSRF related) but is another problem with deletion. The JS for grabbing all the checkboxes by name wasn't working when there is only one checkbox. To test, apply the patch and delete all but one image from the patron card creator image manager. - Check the checkbox for the last image and click the "Delete selected" button. - The image should be deleted successfully. Sponsored-by: Athens County Public Libraries Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Nice work everyone! Pushed to main for 25.11 Nice work everyone! Pushed to 25.05.x for 25.05.03 |