koha-backend.js uses a lot of post requests to the svc api, we need to cover these. This si complicated by the fact that these apis return xml and not json as we usually do
Created attachment 163362 [details] [review] Bug 36351: [failed] Use APIClient for posting
Created attachment 163364 [details] [review] Bug 36351: Add CSRF tokens to advanced cataloguing editor POST requests The editor uses ajax post requests to SVC api. Becuase these apis are XML based requests, they must be handled in the simplest way, by embedding the token as a header To test: 1 - Browse to Cataloguing->Advanced editor 2 - Fill out needed values and save 3 - 403 error 4 - Apply patch 5 - Reload and try agian, success! 6 - Edit and save again, success!
Created attachment 163387 [details] [review] Bug 36351: Add CSRF tokens to advanced cataloguing editor POST requests The editor uses ajax post requests to SVC api. Becuase these apis are XML based requests, they must be handled in the simplest way, by embedding the token as a header To test: 1 - Browse to Cataloguing->Advanced editor 2 - Fill out needed values and save 3 - 403 error 4 - Apply patch 5 - Reload and try agian, success! 6 - Edit and save again, success!
Created attachment 163388 [details] [review] Bug 36351: Fix http-client when response is not JSON
Fixed your first patch. Seems to work as expected.
Created attachment 163457 [details] [review] Bug 36351: Add CSRF tokens to advanced cataloguing editor POST requests The editor uses ajax post requests to SVC api. Becuase these apis are XML based requests, they must be handled in the simplest way, by embedding the token as a header To test: 1 - Browse to Cataloguing->Advanced editor 2 - Fill out needed values and save 3 - 403 error 4 - Apply patch 5 - Reload and try agian, success! 6 - Edit and save again, success! Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Created attachment 163458 [details] [review] Bug 36351: Fix http-client when response is not JSON Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Created attachment 163459 [details] [review] Bug 36351: Adjust saveRecord and _fromXMLStruct Using the new API Client means we need to handle some calls differently. the http-client is returning only the response, not the text, so we need to handle getting this out with a new async function (or promises, but this works) We also need to adjust _fromXMLStruct as we have reduced the levels in the response by the time it is called This now adds a new 'update' function to the cataloguing client as well. Eventually, this should all be using the REST API, but I think for now handling the non-standard responses gets it working again To test: To test: 1 - Browse to Cataloguing->Advanced editor 2 - New Record 3 - Enter values and save - confirm it works 4 - Confirm url now ends in : editor.pl#catalog/{biblionumber} and not editor.pl#new 5 - Save the record again, confirm biblio is updated and not saved as new Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Created attachment 163489 [details] [review] Bug 36351: Add CSRF tokens to advanced cataloguing editor POST requests The editor uses ajax post requests to SVC api. Becuase these apis are XML based requests, they must be handled in the simplest way, by embedding the token as a header To test: 1 - Browse to Cataloguing->Advanced editor 2 - Fill out needed values and save 3 - 403 error 4 - Apply patch 5 - Reload and try agian, success! 6 - Edit and save again, success! Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Created attachment 163490 [details] [review] Bug 36351: Fix http-client when response is not JSON Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Created attachment 163491 [details] [review] Bug 36351: Adjust saveRecord and _fromXMLStruct Using the new API Client means we need to handle some calls differently. the http-client is returning only the response, not the text, so we need to handle getting this out with a new async function (or promises, but this works) We also need to adjust _fromXMLStruct as we have reduced the levels in the response by the time it is called This now adds a new 'update' function to the cataloguing client as well. Eventually, this should all be using the REST API, but I think for now handling the non-standard responses gets it working again To test: To test: 1 - Browse to Cataloguing->Advanced editor 2 - New Record 3 - Enter values and save - confirm it works 4 - Confirm url now ends in : editor.pl#catalog/{biblionumber} and not editor.pl#new 5 - Save the record again, confirm biblio is updated and not saved as new Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Created attachment 163492 [details] [review] Bug 36351: Pretty the api-client Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
There are some new and some pre-existing translatability issues with this one, I filed a separate bug: Bug 36377 - Fix translatability issues in koha-backend.js
Pushed for 24.05! Well done everyone, thank you!
Error in dependency bug number ? It is Bug 34478 "Full CSRF protection" right ?
(In reply to Fridolin Somers from comment #15) > Error in dependency bug number ? > It is Bug 34478 "Full CSRF protection" right ? I fixed it No backport