Bug 18975 - Wrong CSRF token when emailing cart contents
Summary: Wrong CSRF token when emailing cart contents
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: master
Hardware: All All
: P5 - low major (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-07-24 13:15 UTC by Barry Cannon
Modified: 2018-06-04 20:15 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 18975: Retrieve up-to-date CGISESSID when just logged in (1.38 KB, patch)
2017-12-21 20:17 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 18975: Retrieve up-to-date CGISESSID when just logged in (1.43 KB, patch)
2018-02-12 15:04 UTC, Claire Gravely
Details | Diff | Splinter Review
Bug 18975: Retrieve up-to-date CGISESSID when just logged in (1.43 KB, patch)
2018-02-17 15:05 UTC, Nick Clemens
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Barry Cannon 2017-07-24 13:15:48 UTC
When you are not logged into the OPAC and attempt to email the contents of your cart you get the following error : "Wrong CSRF token at /usr/share/koha/opac/cgi-bin/opac/opac-sendbasket.pl line 55"

Some testing shows:

If you log in before adding items to your cart then send it, it works. If you're not logged in and you log in as part of sending the basket, the error occurs

It must be that authenticating in that window doesn't set the session and id / secret aren't being set before submitting
If you aren't logged in, click send the basket and log in, refresh the page before sending, then send, it forces it to pick up the session and works
Comment 1 Liz Rea 2017-11-05 22:10:22 UTC
I confirm this bug in 16.11.05.
Comment 2 Jonathan Druart 2017-12-21 19:18:21 UTC
It affects master as well
Comment 3 Jonathan Druart 2017-12-21 20:17:40 UTC
Created attachment 70084 [details] [review]
Bug 18975: Retrieve up-to-date CGISESSID when just logged in

If a user is asked to login before sending a card, the wrong (old)
CGISESSID cookie is used.
We need to retrieve the one that has just been created.

This will certainly need more work, I guess other scripts are affected
too.
Comment 4 Katrin Fischer 2018-02-11 16:14:35 UTC
Should this be NSO?
Comment 5 Jonathan Druart 2018-02-12 14:02:55 UTC
I do not have time to investigate more the other scripts, but this one patch can be tested yes.
Comment 6 Claire Gravely 2018-02-12 15:04:51 UTC
Created attachment 71480 [details] [review]
Bug 18975: Retrieve up-to-date CGISESSID when just logged in

If a user is asked to login before sending a card, the wrong (old)
CGISESSID cookie is used.
We need to retrieve the one that has just been created.

This will certainly need more work, I guess other scripts are affected
too.

Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>
Comment 7 Nick Clemens 2018-02-17 15:05:32 UTC
Created attachment 71883 [details] [review]
Bug 18975: Retrieve up-to-date CGISESSID when just logged in

If a user is asked to login before sending a card, the wrong (old)
CGISESSID cookie is used.
We need to retrieve the one that has just been created.

This will certainly need more work, I guess other scripts are affected
too.

Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>
Comment 8 Jonathan Druart 2018-02-18 19:49:35 UTC
Pushed to master for 18.05, thanks to everybody involved!
Comment 9 Nick Clemens 2018-02-26 11:39:53 UTC
Awesome work all! Pushed to stable for 17.11.03