It’s no longer possible to delete news entries from the homepage in the staff interface. To reproduce the bug: 1) Go to “Tools > News > New entry” 2) “Display location” should be set to “Staff interface” 3) Fill in the fields 4) Return to the homepage 5) Try to delete the newly created news entry 6) The “Additional contents” page is displayed with the message “There are no additional contents.” 7) Return to the homepage; the news entry is not deleted. The “Additional contents” page expects to receive a CSRF token, but none is sent, causing the issue.
Created attachment 156801 [details] [review] Bug 35019: Add a CSRF token when deleting news I add a CSRF token as a parameter in the link for deleting a news entry, which solves the problem. TEST PLAN 1) Apply the patch 2) Go to “Tools > News > New entry” 3) “Display location” should be set to “Staff interface” 4) Fill in the fields 5) Return to the homepage 6) Delete the created news entry 7) The “Additional contents” page is displayed, and the deleted news entry no longer appears 8) Return to the homepage; the news entry no longer displays
Created attachment 156802 [details] [review] Bug 35019: Add a CSRF token when deleting news I add a CSRF token as a parameter in the link for deleting a news entry, which solves the problem. TEST PLAN 1) Apply the patch 2) Go to "Tools > News > New entry" 3) "Display location" should be set to "Staff interface" 4) Fill in the fields 5) Return to the homepage 6) Delete the created news entry 7) The "Additional contents" page is displayed, and the deleted news entry no longer appears 8) Return to the homepage; the news entry no longer displays
Created attachment 156822 [details] [review] Bug 35019: Add a CSRF token when deleting news I add a CSRF token as a parameter in the link for deleting a news entry, which solves the problem. TEST PLAN 1) Apply the patch 2) Go to "Tools > News > New entry" 3) "Display location" should be set to "Staff interface" 4) Fill in the fields 5) Return to the homepage 6) Delete the created news entry 7) The "Additional contents" page is displayed, and the deleted news entry no longer appears 8) Return to the homepage; the news entry no longer displays Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Created attachment 157215 [details] [review] Bug 35019: Add a CSRF token when deleting news I add a CSRF token as a parameter in the link for deleting a news entry, which solves the problem. TEST PLAN 1) Apply the patch 2) Go to "Tools > News > New entry" 3) "Display location" should be set to "Staff interface" 4) Fill in the fields 5) Return to the homepage 6) Delete the created news entry 7) The "Additional contents" page is displayed, and the deleted news entry no longer appears 8) Return to the homepage; the news entry no longer displays Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Pushed to master for 23.11. Nice work everyone, thanks!
Pushed to 23.05.x for 23.05.05
On a side note, generally speaking, we want to avoid putting CSRF tokens in GET requests, and we want to avoid state changes via GET requests. This could've been an opportunity to refactor this delete to use a POST instead. At some point, I think we'll update the coding guidelines to reflect that, but just a FYI to folk.
Nice work everyone! Pushed to oldstable for 22.11.x