Bug 34601 - Cannot manage suggestions without CSRF error
Summary: Cannot manage suggestions without CSRF error
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Circulation (show other bugs)
Version: Main
Hardware: All All
: P5 - low major (vote)
Assignee: Lucas Gass
QA Contact: Katrin Fischer
URL:
Keywords:
Depends on: 22990
Blocks:
  Show dependency treegraph
 
Reported: 2023-08-23 17:45 UTC by Lucas Gass
Modified: 2023-12-28 20:47 UTC (History)
20 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.11.00,23.05.04,22.11.10,22.05.16


Attachments
Bug 34601: Pass module into params (2.37 KB, patch)
2023-08-23 17:48 UTC, Lucas Gass
Details | Diff | Splinter Review
Bug 34601: Fix edit/delete links on suggestion.tt (3.87 KB, patch)
2023-08-23 18:20 UTC, Lucas Gass
Details | Diff | Splinter Review
Bug 34601: Fix edit/delete links on suggestion.tt (3.94 KB, patch)
2023-08-23 21:17 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 34601: Fix edit/delete links on suggestion.tt (4.13 KB, patch)
2023-08-24 19:50 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 34601: (QA follow-up) Fix edit/delete links in toolbar (2.01 KB, patch)
2023-08-24 19:50 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 34601: [22.11.x]Fix edit/delete links on suggestion.tt (4.67 KB, patch)
2023-08-24 21:52 UTC, Lucas Gass
Details | Diff | Splinter Review
Bug 34601: Fix wrong quote (2.30 KB, patch)
2023-08-30 11:52 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 34601: [22.05.x] Fix edit/delete links on suggestion.tt (4.73 KB, patch)
2023-09-22 18:26 UTC, Lucas Gass
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Lucas Gass 2023-08-23 17:45:47 UTC
To recreate: 

1. Make a suggestion 
2. Try to edit, delete, or manage the suggestion. 
3. Error: 

The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.
Comment 1 Lucas Gass 2023-08-23 17:47:13 UTC
It looks like the params->{module} doesn't get passed so it output_and_exit_if_error exits.
Comment 2 Lucas Gass 2023-08-23 17:48:53 UTC
Created attachment 154719 [details] [review]
Bug 34601: Pass module into params

1. Make a suggestion
2. Try to edit, delete, or manage the suggestion.
3. Error:
4. Apply patch and restart_all
5. Try again and you should not get the error anymore.
Comment 3 Lucas Gass 2023-08-23 18:20:30 UTC
Created attachment 154720 [details] [review]
Bug 34601: Fix edit/delete links on suggestion.tt

1. Make a suggestion
2. Try to edit, delete the suggestion.
3. Error:
4. Apply patch and restart_all
5. Try again and you should not get the error anymore.
Comment 4 Lucas Gass 2023-08-23 18:25:47 UTC
Marked as major as it prevents libraries from managing suggestions.
Comment 5 Andrew Fuerste-Henry 2023-08-23 21:17:39 UTC
Created attachment 154724 [details] [review]
Bug 34601: Fix edit/delete links on suggestion.tt

1. Make a suggestion
2. Try to edit, delete the suggestion.
3. Error:
4. Apply patch and restart_all
5. Try again and you should not get the error anymore.

Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>
Comment 6 Katrin Fischer 2023-08-24 19:36:35 UTC
Lucas, please remember to run the new perltidy on your changes and the QA test tools! (I amended the patch)
Comment 7 Katrin Fischer 2023-08-24 19:50:05 UTC
Created attachment 154747 [details] [review]
Bug 34601: Fix edit/delete links on suggestion.tt

1. Make a suggestion
2. Try to edit, delete the suggestion.
3. Error:
4. Apply patch and restart_all
5. Try again and you should not get the error anymore.

Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 8 Katrin Fischer 2023-08-24 19:50:09 UTC
Created attachment 154748 [details] [review]
Bug 34601: (QA follow-up) Fix edit/delete links in toolbar

We also need to fix the links in the toolbar visible when
'viewing' the suggestion.

1) Create a suggestion
2) Click on the title
3) Click edit > CSRF error
4) Click delete link in toolbar > CSRF error
5) Apply patch and repeat

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 9 Lucas Gass 2023-08-24 21:52:37 UTC
Created attachment 154762 [details] [review]
Bug 34601: [22.11.x]Fix edit/delete links on suggestion.tt
Comment 10 Katrin Fischer 2023-08-24 22:50:50 UTC
Lucas, did you see my follow-up? the original patch was incomplete.
Comment 11 Lucas Gass 2023-08-24 23:14:44 UTC
(In reply to Katrin Fischer from comment #10)
> Lucas, did you see my follow-up? the original patch was incomplete.

Yes, I did. Thanks! I squashed those together for the 22.11 one.
Comment 12 Katrin Fischer 2023-08-24 23:22:06 UTC
(In reply to Lucas Gass from comment #11)
> (In reply to Katrin Fischer from comment #10)
> > Lucas, did you see my follow-up? the original patch was incomplete.
> 
> Yes, I did. Thanks! I squashed those together for the 22.11 one.

All good then :)
Comment 13 Martin Renvoize 2023-08-25 06:46:54 UTC
Beware.. I think the archive/unarchive links also need the same treatment ;P
Comment 14 Katrin Fischer 2023-08-25 09:53:35 UTC
I'll look into providing another follow-up.
Comment 15 Katrin Fischer 2023-08-25 09:55:32 UTC
(In reply to Martin Renvoize from comment #13)
> Beware.. I think the archive/unarchive links also need the same treatment ;P

I just tested the archiving and unarchiving of a suggestion and they still work without any error with the other 2 patches applied.
Comment 16 Martin Renvoize 2023-08-25 10:07:40 UTC
Excellent, that's good news. Thanks for testing it.
Comment 17 Tomás Cohen Arazi 2023-08-29 12:44:06 UTC
The need for the follow-up makes it suspicious. Aren't we over-requiring CSRF tokens here?
Comment 18 Tomás Cohen Arazi 2023-08-29 17:36:48 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 19 Fridolin Somers 2023-08-30 06:43:57 UTC
Ich,

Typo in commit of master :

https://git.koha-community.org/Koha-community/Koha/src/commit/7d5dc65867a55045fa32189d177379e70ecf5725/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt#L850

<a class="deletesuggestion" href="suggestion.pl?op=delete&amp;suggestionid=[% s.suggestionid | html %]"&amp;csrf_token=[% csrf_token | html %]>

Double quote misplaced.
Comment 20 Kelly McElligott 2023-08-30 11:42:17 UTC
Can we get this backported?
Comment 21 Tomás Cohen Arazi 2023-08-30 11:52:45 UTC
Created attachment 154951 [details] [review]
Bug 34601: Fix wrong quote

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 22 Tomás Cohen Arazi 2023-08-30 11:54:07 UTC
(In reply to Fridolin Somers from comment #19)
> Ich,
> 
> Typo in commit of master :

Thanks!
Comment 23 Fridolin Somers 2023-08-30 19:56:02 UTC
Pushed to 23.05.x for 23.05.04
Comment 24 Matt Blenkinsop 2023-08-31 10:37:19 UTC
Nice work everyone!

Pushed to oldstable for 22.11.x
Comment 25 Matt Blenkinsop 2023-08-31 10:37:48 UTC
Thanks for the 22.11 patch!
Comment 26 apirak 2023-09-20 09:22:32 UTC
It happend on 22.05.15. Can we get this backported?
Comment 27 Lucas Gass 2023-09-22 18:26:50 UTC
Created attachment 156122 [details] [review]
Bug 34601: [22.05.x] Fix edit/delete links on suggestion.tt
Comment 28 Lucas Gass 2023-09-22 18:28:32 UTC
Backported to 22.05.x for upcoming 22.05.16