Bug 41812

Summary: xt/find-missing-csrf.t failing when JS contains csrf_token hidden input
Product: Koha Reporter: Jonathan Druart <jonathan.druart>
Component: Test SuiteAssignee: Jonathan Druart <jonathan.druart>
Status: Pushed to main --- QA Contact: Nick Clemens (kidclamp) <nick>
Severity: normal    
Priority: P5 - low CC: lucas
Version: unspecified   
Hardware: All   
OS: All   
GIT URL: Initiative type: ---
Sponsorship status: --- Comma delimited list of Sponsors:
Crowdfunding goal: 0 Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
26.05.00
Circulation function:
Bug Depends on: 41565    
Bug Blocks:    
Attachments: Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS
Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS
Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS

Description Jonathan Druart 2026-02-10 20:14:30 UTC
commit 7a80a9be011071d504b7ed2aa2190433aed772a5
  Bug 41565: Tidy kohaTable - bookings/list.tt

+                            const csrf_token = $('meta[name="csrf-token"]').attr("content");
                             result += `
                                 <form name="checkout-transform" method="post" action="/cgi-bin/koha/circ/circulation.pl?borrowernumber=%s">
-                                    [% INCLUDE 'csrf-token.inc' %]
+                                    <input type="hidden" name="csrf_token" value="${csrf_token}" />
                                     <input type="hidden" name="op" value="cud-checkout"/>
                                     <input type="hidden" name="borrowernumber" value="%s"/>
                                     <input type="hidden" name="barcode" value="%s"/>

This code injected the csrf token using the TT include file, that made pass xt/find-missing-csrf.t

This bug removed the TT tags from the script tags, and we now need to use a JS variable and retrieve the csrf token from the meta tag.

The test needs to be adjusted.
Comment 1 Jonathan Druart 2026-02-10 20:18:40 UTC
Created attachment 192944 [details] [review]
Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS

This code injected the csrf token using the TT include file, that made
pass xt/find-missing-csrf.t

This bug removed the TT tags from the script tags, and we now need to
use a JS variable and retrieve the csrf token from the meta tag.

This patch suggests to adjust the script to ignore this case. We could
also rewrite the whole JS code and use built the HTML elements using
vanilla JS but that's for another day...
Comment 2 Jonathan Druart 2026-02-10 20:23:47 UTC
The regex is very specific on purpose, to not ignore positives.
Comment 3 Lucas Gass (lukeg) 2026-02-10 20:27:37 UTC
Created attachment 192945 [details] [review]
Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS

This code injected the csrf token using the TT include file, that made
pass xt/find-missing-csrf.t

This bug removed the TT tags from the script tags, and we now need to
use a JS variable and retrieve the csrf token from the meta tag.

This patch suggests to adjust the script to ignore this case. We could
also rewrite the whole JS code and use built the HTML elements using
vanilla JS but that's for another day...

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Comment 4 Nick Clemens (kidclamp) 2026-02-10 20:38:25 UTC
Created attachment 192946 [details] [review]
Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS

This code injected the csrf token using the TT include file, that made
pass xt/find-missing-csrf.t

This bug removed the TT tags from the script tags, and we now need to
use a JS variable and retrieve the csrf token from the meta tag.

This patch suggests to adjust the script to ignore this case. We could
also rewrite the whole JS code and use built the HTML elements using
vanilla JS but that's for another day...

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 5 Lucas Gass (lukeg) 2026-02-10 22:52:34 UTC
Pushed to main for 26.05.00.

Thanks all!