Bug 18740 - [16.05.12-16.05.13] Cannot modify patron password
Summary: [16.05.12-16.05.13] Cannot modify patron password
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: 16.05
Hardware: All All
: P5 - low major (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on: 16992
Blocks:
  Show dependency treegraph
 
Reported: 2017-06-06 19:40 UTC by Jonathan Druart
Modified: 2019-06-27 09:24 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 18740: (bug 16992 follow-up) Add CSRF token to the template (1.55 KB, patch)
2017-06-06 19:44 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 18740: (bug 16992 follow-up) Add CSRF token to the template (1.64 KB, patch)
2017-06-06 19:56 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
work-around without patch (65.83 KB, image/png)
2017-06-13 08:54 UTC, Mason James
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2017-06-06 19:40:13 UTC

    
Comment 1 Jonathan Druart 2017-06-06 19:44:03 UTC
Created attachment 64067 [details] [review]
Bug 18740: (bug 16992 follow-up) Add CSRF token to the template

Bug 16992 is in
  commit 9e74db7b51085f62919e34ab4e5ccdf9da2066a1
    Bug 18124: Restrict CSRF token to user's session

but template change is missing

Test plan:
Modify a patron from member-password.pl
Without this patch you got
  Wrong CSRF token at /home/vagrant/kohaclone/members/member-password.pl line 68.
Comment 2 Tomás Cohen Arazi 2017-06-06 19:56:11 UTC
Created attachment 64068 [details] [review]
Bug 18740: (bug 16992 follow-up) Add CSRF token to the template

Bug 16992 is in
  commit 9e74db7b51085f62919e34ab4e5ccdf9da2066a1
    Bug 18124: Restrict CSRF token to user's session

but template change is missing

Test plan:
Modify a patron from member-password.pl
Without this patch you got
  Wrong CSRF token at /home/vagrant/kohaclone/members/member-password.pl line 68.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Patch fixes the bug. Passes the qa script.
Comment 3 Mason James 2017-06-13 06:04:15 UTC
(In reply to Tomás Cohen Arazi from comment #2)
> Created attachment 64068 [details] [review] [review]
> Bug 18740: (bug 16992 follow-up) Add CSRF token to the template
> 
> Bug 16992 is in
>   commit 9e74db7b51085f62919e34ab4e5ccdf9da2066a1
>     Bug 18124: Restrict CSRF token to user's session
> 
> but template change is missing
> 
> Test plan:
> Modify a patron from member-password.pl
> Without this patch you got
>   Wrong CSRF token at /home/vagrant/kohaclone/members/member-password.pl
> line 68.
> 
> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
> Patch fixes the bug. Passes the qa script.

I've tested this as working OK, so I'll include this patch in an early release

Thanks Joubu and Tomás for sorting this bug :0)
Comment 4 Mason James 2017-06-13 06:04:35 UTC
Pushed to 16.05.x, for 16.05.14 release
Comment 5 Mason James 2017-06-13 08:54:57 UTC
Created attachment 64254 [details]
work-around without patch
Comment 6 Mason James 2017-06-13 08:56:12 UTC
(In reply to Mason James from comment #5)
> Created attachment 64254 [details]
> work-around without patch

i did find a work-around for this bug, without the patch

it's possible to change a password using the members/memberentry.pl page