Bug 36194 - CSRF - svc (2/2)
Summary: CSRF - svc (2/2)
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low critical (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on: 36094 36084
Blocks: 36192
  Show dependency treegraph
 
Reported: 2024-02-28 14:01 UTC by Nick Clemens
Modified: 2024-03-03 23:07 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens 2024-02-28 14:01:20 UTC
This bug is for tracking follow-ups missed in the initial review. Please see the "svc" section on the framapad here:
https://annuel.framapad.org/p/koha_34478_remaining

Additional entries can be added there, and should be crossed out when completed

Patches should be attached here

This bug can be closed when that section of the pad is empty

see bug 36084 commits for new method using fetch/api-client.js is retrieved (and adjusted) from the Vue work

wiki/coding guideline to follow
Comment 2 Jonathan Druart 2024-02-29 07:54:07 UTC
(In reply to Nick Clemens from comment #1)
> https://wiki.koha-community.org/wiki/Coding_Guidelines#JS13:
> _Fetching_resources

Note that we do not necessarily need to use this method to fix the remaining svc occurrences.
We can simply reject non-POST requests, or add a cud op when missing.
Comment 3 Jonathan Druart 2024-02-29 07:54:37 UTC
Note that svc/authentication has its own bug 36094.