Bug 34650 - Editing/deleting lists from toolbar on virtualshelves/shelves.pl causes CSRF error
Summary: Editing/deleting lists from toolbar on virtualshelves/shelves.pl causes CSRF ...
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Lists (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: David Cook
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on: 22990
Blocks:
  Show dependency treegraph
 
Reported: 2023-08-29 22:14 UTC by Lucas Gass (lukeg)
Modified: 2023-12-28 20:47 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.11.00,23.05.04,22.11.10
Circulation function:


Attachments
Bug 34650: Add CSRF token to edit/delete toolbar links (3.05 KB, patch)
2023-08-29 22:19 UTC, Lucas Gass (lukeg)
Details | Diff | Splinter Review
Bug 34650: Remove unnecessary CSRF check on edit_form (2.02 KB, patch)
2023-08-30 00:33 UTC, David Cook
Details | Diff | Splinter Review
Bug 34650: Convert list toolbar delete into form POST (3.17 KB, patch)
2023-08-30 00:33 UTC, David Cook
Details | Diff | Splinter Review
Bug 34650: Remove unnecessary CSRF check on edit_form (2.08 KB, patch)
2023-08-30 13:38 UTC, Lucas Gass (lukeg)
Details | Diff | Splinter Review
Bug 34650: Convert list toolbar delete into form POST (3.23 KB, patch)
2023-08-30 13:38 UTC, Lucas Gass (lukeg)
Details | Diff | Splinter Review
Bug 34650: Remove unnecessary CSRF check on edit_form (2.17 KB, patch)
2023-09-01 09:47 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 34650: Convert list toolbar delete into form POST (3.32 KB, patch)
2023-09-01 09:47 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Lucas Gass (lukeg) 2023-08-29 22:14:58 UTC
To recreate:

1. Add a list
2. Go to that list ( virtualshelves/shelves.pl?op=view&shelfnumber=X )
3. From the toolbar click the 'Edit' dropdown. 
4. From the dropdown try either 'Edit list' or 'Delete list'.
5. CSRF error
Comment 1 Lucas Gass (lukeg) 2023-08-29 22:19:37 UTC
Created attachment 154926 [details] [review]
Bug 34650: Add CSRF token to edit/delete toolbar links

To test:
1. Add a list
2. Go to that list ( virtualshelves/shelves.pl?op=view&shelfnumber=X )
3. From the toolbar click the 'Edit' dropdown.
4. From the dropdown try either 'Edit list' or 'Delete list'.
5. CSRF error
6. APPLY PATCH
7. Try 2 - 4 again, no more error.
Comment 2 David Cook 2023-08-29 23:16:16 UTC
Technically, we should be looking at changing these GETs to POSTs, although I don't know if we have at-hand styling to do that. 

I will take a quick look to see if I can do a little alternative. If not, I'll sign off...
Comment 3 David Cook 2023-08-29 23:59:33 UTC
op=edit_form shouldn't need a CSRF token either since it's not state changing...
Comment 4 David Cook 2023-08-29 23:59:58 UTC
(In reply to David Cook from comment #3)
> op=edit_form shouldn't need a CSRF token either since it's not state
> changing...

I mean the previous change wasn't correct.
Comment 5 David Cook 2023-08-30 00:33:28 UTC
Created attachment 154933 [details] [review]
Bug 34650: Remove unnecessary CSRF check on edit_form

The op "edit_form" doesn't change state. It just renders the edit
form. Therefore, it doesn't need a CSRF token/check.
Comment 6 David Cook 2023-08-30 00:33:30 UTC
Created attachment 154934 [details] [review]
Bug 34650: Convert list toolbar delete into form POST

This patch adds a HTML form with a CSRF token to POST the list delete,
which is triggered by a click handler on the A element. The A element
is still needed for existing style reasons.

Test plan:
0. Apply patch
1. koha-plack --reload kohadev
2. In the staff interface, add a list
3. Go into that list (e.g. virtualshelves/shelves.pl?op=view&shelfnumber=X)
4. From the toolbar click the "Edit" dropdown
5. From the dropdown try either "Edit list" or "Delete list"
6. Note no CSRF error and operation completes as expected
Comment 7 David Cook 2023-08-30 00:35:33 UTC
Sorry for taking this one over, Lucas, but I think this is a better way to go.
Comment 8 Lucas Gass (lukeg) 2023-08-30 13:35:22 UTC
(In reply to David Cook from comment #7)
> Sorry for taking this one over, Lucas, but I think this is a better way to
> go.

No problem, thanks!
Comment 9 Lucas Gass (lukeg) 2023-08-30 13:38:19 UTC
Created attachment 154955 [details] [review]
Bug 34650: Remove unnecessary CSRF check on edit_form

The op "edit_form" doesn't change state. It just renders the edit
form. Therefore, it doesn't need a CSRF token/check.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Comment 10 Lucas Gass (lukeg) 2023-08-30 13:38:22 UTC
Created attachment 154956 [details] [review]
Bug 34650: Convert list toolbar delete into form POST

This patch adds a HTML form with a CSRF token to POST the list delete,
which is triggered by a click handler on the A element. The A element
is still needed for existing style reasons.

Test plan:
0. Apply patch
1. koha-plack --reload kohadev
2. In the staff interface, add a list
3. Go into that list (e.g. virtualshelves/shelves.pl?op=view&shelfnumber=X)
4. From the toolbar click the "Edit" dropdown
5. From the dropdown try either "Edit list" or "Delete list"
6. Note no CSRF error and operation completes as expected

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Comment 11 Marcel de Rooy 2023-09-01 09:43:06 UTC
Looking here
Comment 12 Marcel de Rooy 2023-09-01 09:47:35 UTC
Created attachment 155089 [details] [review]
Bug 34650: Remove unnecessary CSRF check on edit_form

The op "edit_form" doesn't change state. It just renders the edit
form. Therefore, it doesn't need a CSRF token/check.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 13 Marcel de Rooy 2023-09-01 09:47:37 UTC
Created attachment 155090 [details] [review]
Bug 34650: Convert list toolbar delete into form POST

This patch adds a HTML form with a CSRF token to POST the list delete,
which is triggered by a click handler on the A element. The A element
is still needed for existing style reasons.

Test plan:
0. Apply patch
1. koha-plack --reload kohadev
2. In the staff interface, add a list
3. Go into that list (e.g. virtualshelves/shelves.pl?op=view&shelfnumber=X)
4. From the toolbar click the "Edit" dropdown
5. From the dropdown try either "Edit list" or "Delete list"
6. Note no CSRF error and operation completes as expected

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 14 Tomás Cohen Arazi (tcohen) 2023-09-01 14:11:02 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 15 Elise Konya 2023-09-07 15:43:50 UTC
Would it be possible to backport this to oldstable and oldoldstable? Thanks, all!
Comment 16 George Williams (NEKLS) 2023-09-07 16:07:17 UTC
(In reply to Elise Konya from comment #15)
> Would it be possible to backport this to oldstable and oldoldstable? Thanks,
> all!

+1
Comment 17 Fridolin Somers 2023-09-08 00:38:31 UTC
Pushed to 23.05.x for 23.05.04
Comment 18 Matt Blenkinsop 2023-09-08 09:48:01 UTC
Nice work everyone!

Pushed to oldstable for 22.11.x