Bug 18975 - Wrong CSRF token when emailing cart contents
Summary: Wrong CSRF token when emailing cart contents
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: Main
Hardware: All All
: P5 - low major
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-07-24 13:15 UTC by Barry Cannon
Modified: 2019-10-14 19:57 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Bug 18975: Retrieve up-to-date CGISESSID when just logged in (1.38 KB, patch)
2017-12-21 20:17 UTC, Jonathan Druart 		Details | Diff | Splinter Review
Bug 18975: Retrieve up-to-date CGISESSID when just logged in (1.43 KB, patch)
2018-02-12 15:04 UTC, Claire Gravely 		Details | Diff | Splinter Review
Bug 18975: Retrieve up-to-date CGISESSID when just logged in (1.43 KB, patch)
2018-02-17 15:05 UTC, Nick Clemens (kidclamp) 		Details | Diff | Splinter Review
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Barry Cannon 2017-07-24 13:15:48 UTC 
When you are not logged into the OPAC and attempt to email the contents of your cart you get the following error : "Wrong CSRF token at /usr/share/koha/opac/cgi-bin/opac/opac-sendbasket.pl line 55"

Some testing shows:

If you log in before adding items to your cart then send it, it works. If you're not logged in and you log in as part of sending the basket, the error occurs

It must be that authenticating in that window doesn't set the session and id / secret aren't being set before submitting
If you aren't logged in, click send the basket and log in, refresh the page before sending, then send, it forces it to pick up the session and works
Comment 1 Liz Rea 2017-11-05 22:10:22 UTC 
I confirm this bug in 16.11.05.
Comment 2 Jonathan Druart 2017-12-21 19:18:21 UTC 
It affects master as well
Comment 3 Jonathan Druart 2017-12-21 20:17:40 UTC 
Created attachment 70084 [details] [review]
Bug 18975: Retrieve up-to-date CGISESSID when just logged in

If a user is asked to login before sending a card, the wrong (old)
CGISESSID cookie is used.
We need to retrieve the one that has just been created.

This will certainly need more work, I guess other scripts are affected
too.
Comment 4 Katrin Fischer 2018-02-11 16:14:35 UTC 
Should this be NSO?
Comment 5 Jonathan Druart 2018-02-12 14:02:55 UTC 
I do not have time to investigate more the other scripts, but this one patch can be tested yes.
Comment 6 Claire Gravely 2018-02-12 15:04:51 UTC 
Created attachment 71480 [details] [review]
Bug 18975: Retrieve up-to-date CGISESSID when just logged in

If a user is asked to login before sending a card, the wrong (old)
CGISESSID cookie is used.
We need to retrieve the one that has just been created.

This will certainly need more work, I guess other scripts are affected
too.

Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>
Comment 7 Nick Clemens (kidclamp) 2018-02-17 15:05:32 UTC 
Created attachment 71883 [details] [review]
Bug 18975: Retrieve up-to-date CGISESSID when just logged in

If a user is asked to login before sending a card, the wrong (old)
CGISESSID cookie is used.
We need to retrieve the one that has just been created.

This will certainly need more work, I guess other scripts are affected
too.

Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>
Comment 8 Jonathan Druart 2018-02-18 19:49:35 UTC 
Pushed to master for 18.05, thanks to everybody involved!
Comment 9 Nick Clemens (kidclamp) 2018-02-26 11:39:53 UTC 
Awesome work all! Pushed to stable for 17.11.03