After upgrading to 22.05.004 (and after manually installing `libmojolicious-plugin-openapi-perl` to get patron search to work - as per https://www.mail-archive.com/koha@lists.katipo.co.nz/msg28885.html) we are now seeing an issue uploading patron images. After logging in to Koha, the first attempt to upload an individual patron image (from the patron show screen) fails with a CSRF error: > The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again. Second and subsequent attempts succeed up until we log out and log back in again. After that the first submission once again fails. I tailed the logs to see if I could see any errors using `tail -f /var/log/koha/library/*.log`. On one occasion I saw an error related to `picture_upload.pl` in `/var/log/koha/library/intranet-error.log` but I can't reproduce it. In case it's relevant the error I saw once was: > [Wed Aug 31 09:55:06.665314 2022] [cgi:error] [pid 288501] [client 136.228.129.94:64313] AH01215: Use of uninitialized value $cardnumber in concatenation (.) or string at /usr/share/koha/intranet/cgi-bin/tools/picture-upload.pl line 66.: /usr/share/koha/intranet/cgi-bin/tools/picture-upload.pl, referer: https://<library url>/cgi-bin/koha/circ/circulation.pl?borrowernumber=1790 The CSRF error in the client is reproducible in up-to-date versions of Chrome on Windows and Safari on macOS so it doesn't seem to be browser or OS specific.
I am seeing this issue on the master branch (current development) as well. Updating bug. To test: * Turn on patronimages system preferences * Go to any patron account * Hover over the 'dummy image' for the Add button * Browse and select an image for upload * Saving results in the following error: The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.
Not sure if this is the exact same issue but I'm on 22.05.07 and consistently getting the "Wrong CSRF Token" error any time I try to add a patron photo from any page of the account *other than* the Details (moremember.pl) tab. I've tested with both the snazzy new camera integration and by manually uploading a file, and in both cases, it only succeeds on moremember.pl.
I'm experiencing the same issue as Jason Robb. Works fine on moremember.pl but csrf_token is empty in the html on any of the other patron tab/pages.
Confirmed, I'm experiencing this issue after the 22.05 upgrade also.
I suspect the issue is from bug 20809, members-menu.js: + $(".edit-patronimage").on("click", function(e){ + e.preventDefault(); + var borrowernumber = $(this).data("borrowernumber"); + $.get("/cgi-bin/koha/members/moremember.pl", { borrowernumber : borrowernumber }, function( data ){ + var image_form = $(data).find("#picture-upload"); + image_form.show().find(".cancel").remove(); + $("#patronImageEdit .modal-body").html( image_form ); + }); + var modalTitle = $(this).attr("title"); + $("#patronImageEdit .modal-title").text(modalTitle); + $("#patronImageEdit").modal("show"); + }); It looks like we are fetching the form via JS, maybe is causing the CSRF mismatch?
Created attachment 145303 [details] [review] Bug 31492: Set CSRF token in circulation.pl To test: * Turn on patronimages system preferences * Go to any patron account * Hover over the 'dummy image' for the Add button * Browse and select an image for upload * Saving results in the following error: The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again. Apply patch and try again. You shouldn't need to try twice, it should work on the first attempt now.
Created attachment 145346 [details] [review] Bug 31492: Set CSRF token in circulation.pl To test: * Turn on patronimages system preferences * Go to any patron account * Hover over the 'dummy image' for the Add button * Browse and select an image for upload * Saving results in the following error: The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again. Apply patch and try again. You shouldn't need to try twice, it should work on the first attempt now. Signed-off-by: David Nind <david@davidnind.com>
Testing notes (using koha-testing-docker): 1. No error when using Firefox (on Kubuntu 22.04). After apply patch, continues to work as expected. 2. Error when using Chromium and Google Chrome. Applying the patch successfully fixes the issue.
Created attachment 145347 [details] [review] Bug 31492: Set CSRF token in circulation.pl To test: * Turn on patronimages system preferences * Go to any patron account * Hover over the 'dummy image' for the Add button * Browse and select an image for upload * Saving results in the following error: The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again. Apply patch and try again. You shouldn't need to try twice, it should work on the first attempt now. Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: David Cook <dcook@prosentient.com.au>
Nice work everyone! Pushed to 23.05.x for the next release
Nice work, thanks everyone! Pushed to 22.11.x for the next release.
Backported to 22.05.x for upcoming 22.05.09
applied to 21.11.x for 21.11.16
Not backported to 21.05.x