| Summary: | xt/find-missing-csrf.t failing when JS contains csrf_token hidden input | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Jonathan Druart <jonathan.druart> |
| Component: | Test Suite | Assignee: | Jonathan Druart <jonathan.druart> |
| Status: | Pushed to main --- | QA Contact: | Nick Clemens (kidclamp) <nick> |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | lucas |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
26.05.00
|
|
| Circulation function: | |||
| Bug Depends on: | 41565 | ||
| Bug Blocks: | |||
| Attachments: |
Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS
Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS |
||
|
Description
Jonathan Druart
2026-02-10 20:14:30 UTC
Created attachment 192944 [details] [review] Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS This code injected the csrf token using the TT include file, that made pass xt/find-missing-csrf.t This bug removed the TT tags from the script tags, and we now need to use a JS variable and retrieve the csrf token from the meta tag. This patch suggests to adjust the script to ignore this case. We could also rewrite the whole JS code and use built the HTML elements using vanilla JS but that's for another day... The regex is very specific on purpose, to not ignore positives. Created attachment 192945 [details] [review] Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS This code injected the csrf token using the TT include file, that made pass xt/find-missing-csrf.t This bug removed the TT tags from the script tags, and we now need to use a JS variable and retrieve the csrf token from the meta tag. This patch suggests to adjust the script to ignore this case. We could also rewrite the whole JS code and use built the HTML elements using vanilla JS but that's for another day... Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> Created attachment 192946 [details] [review] Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS This code injected the csrf token using the TT include file, that made pass xt/find-missing-csrf.t This bug removed the TT tags from the script tags, and we now need to use a JS variable and retrieve the csrf token from the meta tag. This patch suggests to adjust the script to ignore this case. We could also rewrite the whole JS code and use built the HTML elements using vanilla JS but that's for another day... Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Pushed to main for 26.05.00. Thanks all! |