Bug 36193 - CSRF - Code review missed
Summary: CSRF - Code review missed
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low critical
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on: 34478
Blocks: 36192
  Show dependency treegraph
 
Reported: 2024-02-28 13:55 UTC by Nick Clemens (kidclamp)
Modified: 2024-12-23 08:06 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00
Circulation function:


Attachments
Bug 36193: Add more request information on Koha::Middleware::CSRF output (2.19 KB, patch)
2024-03-01 18:24 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36193: Fix acq receiving (2.13 KB, patch)
2024-03-04 21:00 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36193: cud- treatment for Acq order receipt cancelling (2.68 KB, patch)
2024-03-04 22:38 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36193: cud- treatment for cash_registers.pl (6.67 KB, patch)
2024-03-05 14:24 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36193: cud- treatment for credit_types.pl (4.57 KB, patch)
2024-03-05 14:33 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36193: cud- treatment for dedit_types.pl (4.55 KB, patch)
2024-03-05 14:41 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36193: cud- treatment for reset_confirmed on mappings.pl (1.00 KB, patch)
2024-03-05 14:47 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36193: cud- treatment for restrictions.pl (3.11 KB, patch)
2024-03-05 14:59 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36193: Add more request information on Koha::Middleware::CSRF output (2.25 KB, patch)
2024-03-05 16:24 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 36193: Fix acq receiving (2.18 KB, patch)
2024-03-05 16:24 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 36193: cud- treatment for Acq order receipt cancelling (2.73 KB, patch)
2024-03-05 16:24 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 36193: cud- treatment for cash_registers.pl (6.72 KB, patch)
2024-03-05 16:24 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 36193: cud- treatment for credit_types.pl (4.62 KB, patch)
2024-03-05 16:24 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 36193: cud- treatment for dedit_types.pl (4.60 KB, patch)
2024-03-05 16:24 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 36193: cud- treatment for reset_confirmed on mappings.pl (1.06 KB, patch)
2024-03-05 16:24 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 36193: cud- treatment for restrictions.pl (3.17 KB, patch)
2024-03-05 16:24 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 36193: (follow-up) Use buttons and don't nest forms (17.51 KB, patch)
2024-03-05 16:24 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 36193: (follow-up) Use buttons and don't nest forms (17.56 KB, patch)
2024-03-05 17:10 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36193: Make restore icon consistent in cash registers (1.50 KB, patch)
2024-03-06 11:54 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36193: cud- treatment for catalogue/stockrotation.pl (7.77 KB, patch)
2024-03-06 11:54 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36193: cud- treatment for tools/stockrotation.pl (14.05 KB, patch)
2024-03-06 15:45 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens (kidclamp) 2024-02-28 13:55:26 UTC
This bug is for tracking follow-ups missed in the initial review. Please see the "Code review missed" section on the framapad here:
https://annuel.framapad.org/p/koha_34478_remaining

Additional entries can be added there, and should be crossed out when completed

Patches should be attached here

This bug can be closed when that section of the pad is empty
Comment 1 Tomás Cohen Arazi (tcohen) 2024-03-01 18:24:54 UTC
Created attachment 162684 [details] [review]
Bug 36193: Add more request information on Koha::Middleware::CSRF output

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 2 David Cook 2024-03-04 04:36:30 UTC
I'm not sure if I fully understand. It looks like bug 34478 accidentally broke the Oauth/OIDC SSO, so I've fixed it on bug 36219. Should I have added that patch here instead?
Comment 3 Nick Clemens (kidclamp) 2024-03-04 11:23:50 UTC
(In reply to David Cook from comment #2)
> I'm not sure if I fully understand. It looks like bug 34478 accidentally
> broke the Oauth/OIDC SSO, so I've fixed it on bug 36219. Should I have added
> that patch here instead?

The idea was simply to reduce the number of bugs filed, for what will likely be similar patches - it is perfectly okay that you filed a new bug, and it is for a distinct issue, and you linked it to the others. This is going to be a bit messy, so we just do our best to keep things clear and simple, and I think you did.
Comment 4 Tomás Cohen Arazi (tcohen) 2024-03-04 21:00:25 UTC
Created attachment 162733 [details] [review]
Bug 36193: Fix acq receiving

This patch addresses the CSRF error when receiving in acquisitions.

To test:
1. Have at least one order to receive
2. Follow the steps to receive them
3. Have the logs open:
   $ ktd --shell
  k$ tail -f /var/log/koha/kohadev/*.log
4. Click to confirm receipt
=> FAIL: An error modal is displayed
=> FAIL: There's an error about missing CSRF token in POST
5. Apply this patch
6. Reload everything:
  k$ restart_all
7. Repeat 1-4
=> SUCCESS: Receipt works :-D
=> SUCCESS: No error log
8. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 5 Tomás Cohen Arazi (tcohen) 2024-03-04 22:38:39 UTC
Created attachment 162734 [details] [review]
Bug 36193: cud- treatment for Acq order receipt cancelling

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 6 Tomás Cohen Arazi (tcohen) 2024-03-05 14:24:04 UTC
Created attachment 162749 [details] [review]
Bug 36193: cud- treatment for cash_registers.pl

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 7 Tomás Cohen Arazi (tcohen) 2024-03-05 14:33:29 UTC
Created attachment 162750 [details] [review]
Bug 36193: cud- treatment for credit_types.pl

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 8 Tomás Cohen Arazi (tcohen) 2024-03-05 14:41:04 UTC
Created attachment 162751 [details] [review]
Bug 36193: cud- treatment for dedit_types.pl

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 9 Tomás Cohen Arazi (tcohen) 2024-03-05 14:47:05 UTC
Created attachment 162752 [details] [review]
Bug 36193: cud- treatment for reset_confirmed on mappings.pl

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 10 Tomás Cohen Arazi (tcohen) 2024-03-05 14:59:20 UTC
Created attachment 162755 [details] [review]
Bug 36193: cud- treatment for restrictions.pl

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 11 Nick Clemens (kidclamp) 2024-03-05 16:24:29 UTC
Created attachment 162769 [details] [review]
Bug 36193: Add more request information on Koha::Middleware::CSRF output

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 12 Nick Clemens (kidclamp) 2024-03-05 16:24:31 UTC
Created attachment 162770 [details] [review]
Bug 36193: Fix acq receiving

This patch addresses the CSRF error when receiving in acquisitions.

To test:
1. Have at least one order to receive
2. Follow the steps to receive them
3. Have the logs open:
   $ ktd --shell
  k$ tail -f /var/log/koha/kohadev/*.log
4. Click to confirm receipt
=> FAIL: An error modal is displayed
=> FAIL: There's an error about missing CSRF token in POST
5. Apply this patch
6. Reload everything:
  k$ restart_all
7. Repeat 1-4
=> SUCCESS: Receipt works :-D
=> SUCCESS: No error log
8. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 13 Nick Clemens (kidclamp) 2024-03-05 16:24:33 UTC
Created attachment 162771 [details] [review]
Bug 36193: cud- treatment for Acq order receipt cancelling

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 14 Nick Clemens (kidclamp) 2024-03-05 16:24:35 UTC
Created attachment 162772 [details] [review]
Bug 36193: cud- treatment for cash_registers.pl

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 15 Nick Clemens (kidclamp) 2024-03-05 16:24:37 UTC
Created attachment 162773 [details] [review]
Bug 36193: cud- treatment for credit_types.pl

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 16 Nick Clemens (kidclamp) 2024-03-05 16:24:40 UTC
Created attachment 162774 [details] [review]
Bug 36193: cud- treatment for dedit_types.pl

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 17 Nick Clemens (kidclamp) 2024-03-05 16:24:42 UTC
Created attachment 162775 [details] [review]
Bug 36193: cud- treatment for reset_confirmed on mappings.pl

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 18 Nick Clemens (kidclamp) 2024-03-05 16:24:44 UTC
Created attachment 162776 [details] [review]
Bug 36193: cud- treatment for restrictions.pl

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 19 Nick Clemens (kidclamp) 2024-03-05 16:24:46 UTC
Created attachment 162777 [details] [review]
Bug 36193: (follow-up) Use buttons and don't nest forms

When changing action links into forms, we should use a submit button rather than JS to submit

Receipt cancelling needed a form embedded in the page as we cannot nest forms

Fixed searching on invoice.pl

Fixed resetting mappings (original button did not need cud-)

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 20 Tomás Cohen Arazi (tcohen) 2024-03-05 17:10:16 UTC
Created attachment 162784 [details] [review]
Bug 36193: (follow-up) Use buttons and don't nest forms

When changing action links into forms, we should use a submit button rather than JS to submit

Receipt cancelling needed a form embedded in the page as we cannot nest forms

Fixed searching on invoice.pl

Fixed resetting mappings (original button did not need cud-)

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 21 Tomás Cohen Arazi (tcohen) 2024-03-06 11:54:49 UTC
Created attachment 162830 [details] [review]
Bug 36193: Make restore icon consistent in cash registers

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 22 Tomás Cohen Arazi (tcohen) 2024-03-06 11:54:53 UTC
Created attachment 162831 [details] [review]
Bug 36193: cud- treatment for catalogue/stockrotation.pl

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 23 Tomás Cohen Arazi (tcohen) 2024-03-06 15:45:24 UTC
Created attachment 162837 [details] [review]
Bug 36193: cud- treatment for tools/stockrotation.pl

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 24 Katrin Fischer 2024-03-12 16:22:23 UTC
Pushed all these to master. Handling is a little big finicky. I'd prefer separate bugs from now on if that's OK.
Comment 25 Katrin Fischer 2024-03-12 16:49:33 UTC
Pushed for 24.05!

Well done everyone, thank you!
Comment 26 Fridolin Somers 2024-03-13 06:57:32 UTC
Depends on Bug 34478 no ?
Comment 27 David Cook 2024-03-13 22:15:00 UTC
(In reply to Fridolin Somers from comment #26)
> Depends on Bug 34478 no ?

Yep. I've just added it as a dependency.
Comment 28 Fridolin Somers 2024-04-17 08:47:55 UTC
Depends on Bug 34478 not in 23.11.x