Bug 36351 - CSRF Adjustments for Cataloguing editor
Summary: CSRF Adjustments for Cataloguing editor
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Cataloging (show other bugs)
Version: Main
Hardware: All All
: P5 - low major (vote)
Assignee: Nick Clemens
QA Contact: Jonathan Druart
URL:
Keywords:
Depends on: 34478
Blocks: 36377 36418
  Show dependency treegraph
 
Reported: 2024-03-18 17:28 UTC by Nick Clemens
Modified: 2024-04-17 15:04 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00


Attachments
Bug 36351: [failed] Use APIClient for posting (4.19 KB, patch)
2024-03-18 17:29 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 36351: Add CSRF tokens to advanced cataloguing editor POST requests (2.36 KB, patch)
2024-03-18 17:40 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 36351: Add CSRF tokens to advanced cataloguing editor POST requests (4.57 KB, patch)
2024-03-19 11:05 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 36351: Fix http-client when response is not JSON (2.52 KB, patch)
2024-03-19 11:05 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 36351: Add CSRF tokens to advanced cataloguing editor POST requests (4.62 KB, patch)
2024-03-19 15:40 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 36351: Fix http-client when response is not JSON (2.57 KB, patch)
2024-03-19 15:40 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 36351: Adjust saveRecord and _fromXMLStruct (6.20 KB, patch)
2024-03-19 15:40 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 36351: Add CSRF tokens to advanced cataloguing editor POST requests (4.70 KB, patch)
2024-03-20 05:10 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 36351: Fix http-client when response is not JSON (2.64 KB, patch)
2024-03-20 05:10 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 36351: Adjust saveRecord and _fromXMLStruct (6.27 KB, patch)
2024-03-20 05:10 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 36351: Pretty the api-client (2.02 KB, patch)
2024-03-20 05:10 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens 2024-03-18 17:28:04 UTC
koha-backend.js uses a lot of post requests to the svc api, we need to cover these.

This si complicated by the fact that these apis return xml and not json as we usually do
Comment 1 Nick Clemens 2024-03-18 17:29:10 UTC
Created attachment 163362 [details] [review]
Bug 36351: [failed] Use APIClient for posting
Comment 2 Nick Clemens 2024-03-18 17:40:25 UTC
Created attachment 163364 [details] [review]
Bug 36351: Add CSRF tokens to advanced cataloguing editor POST requests

The editor uses ajax post requests to SVC api.
Becuase these apis are XML based requests, they must be handled in the simplest way, by
embedding the token as a header

To test:
1 - Browse to Cataloguing->Advanced editor
2 - Fill out needed values and save
3 - 403 error
4 - Apply patch
5 - Reload and try agian, success!
6 - Edit and save again, success!
Comment 3 Jonathan Druart 2024-03-19 11:05:41 UTC
Created attachment 163387 [details] [review]
Bug 36351: Add CSRF tokens to advanced cataloguing editor POST requests

The editor uses ajax post requests to SVC api.
Becuase these apis are XML based requests, they must be handled in the simplest way, by
embedding the token as a header

To test:
1 - Browse to Cataloguing->Advanced editor
2 - Fill out needed values and save
3 - 403 error
4 - Apply patch
5 - Reload and try agian, success!
6 - Edit and save again, success!
Comment 4 Jonathan Druart 2024-03-19 11:05:43 UTC
Created attachment 163388 [details] [review]
Bug 36351: Fix http-client when response is not JSON
Comment 5 Jonathan Druart 2024-03-19 11:06:07 UTC
Fixed your first patch. Seems to work as expected.
Comment 6 Nick Clemens 2024-03-19 15:40:41 UTC
Created attachment 163457 [details] [review]
Bug 36351: Add CSRF tokens to advanced cataloguing editor POST requests

The editor uses ajax post requests to SVC api.
Becuase these apis are XML based requests, they must be handled in the simplest way, by
embedding the token as a header

To test:
1 - Browse to Cataloguing->Advanced editor
2 - Fill out needed values and save
3 - 403 error
4 - Apply patch
5 - Reload and try agian, success!
6 - Edit and save again, success!

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 7 Nick Clemens 2024-03-19 15:40:43 UTC
Created attachment 163458 [details] [review]
Bug 36351: Fix http-client when response is not JSON

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 8 Nick Clemens 2024-03-19 15:40:44 UTC
Created attachment 163459 [details] [review]
Bug 36351: Adjust saveRecord and _fromXMLStruct

Using the new API Client means we need to handle some calls differently.
the http-client is returning only the response, not the text, so we need to handle getting this out
with a new async function (or promises, but this works)

We also need to adjust _fromXMLStruct as we have reduced the levels in the response by the time it is called

This now adds a new 'update' function to the cataloguing client as well.

Eventually, this should all be using the REST API, but I think for now handling the non-standard responses gets it
working again

To test:
To test:
1 - Browse to Cataloguing->Advanced editor
2 - New Record
3 - Enter values and save - confirm it works
4 - Confirm url now ends in : editor.pl#catalog/{biblionumber} and not editor.pl#new
5 - Save the record again, confirm biblio is updated and not saved as new

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 9 Jonathan Druart 2024-03-20 05:10:04 UTC
Created attachment 163489 [details] [review]
Bug 36351: Add CSRF tokens to advanced cataloguing editor POST requests

The editor uses ajax post requests to SVC api.
Becuase these apis are XML based requests, they must be handled in the simplest way, by
embedding the token as a header

To test:
1 - Browse to Cataloguing->Advanced editor
2 - Fill out needed values and save
3 - 403 error
4 - Apply patch
5 - Reload and try agian, success!
6 - Edit and save again, success!

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 10 Jonathan Druart 2024-03-20 05:10:07 UTC
Created attachment 163490 [details] [review]
Bug 36351: Fix http-client when response is not JSON

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 11 Jonathan Druart 2024-03-20 05:10:09 UTC
Created attachment 163491 [details] [review]
Bug 36351: Adjust saveRecord and _fromXMLStruct

Using the new API Client means we need to handle some calls differently.
the http-client is returning only the response, not the text, so we need to handle getting this out
with a new async function (or promises, but this works)

We also need to adjust _fromXMLStruct as we have reduced the levels in the response by the time it is called

This now adds a new 'update' function to the cataloguing client as well.

Eventually, this should all be using the REST API, but I think for now handling the non-standard responses gets it
working again

To test:
To test:
1 - Browse to Cataloguing->Advanced editor
2 - New Record
3 - Enter values and save - confirm it works
4 - Confirm url now ends in : editor.pl#catalog/{biblionumber} and not editor.pl#new
5 - Save the record again, confirm biblio is updated and not saved as new

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 12 Jonathan Druart 2024-03-20 05:10:12 UTC
Created attachment 163492 [details] [review]
Bug 36351: Pretty the api-client

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 13 Katrin Fischer 2024-03-20 17:34:19 UTC
There are some new and some pre-existing translatability issues with this one, I filed a separate bug:
Bug 36377 - Fix translatability issues in koha-backend.js
Comment 14 Katrin Fischer 2024-03-20 17:40:36 UTC
Pushed for 24.05!

Well done everyone, thank you!
Comment 15 Fridolin Somers 2024-03-21 13:58:17 UTC
Error in dependency bug number ?
It is Bug 34478 "Full CSRF protection" right ?
Comment 16 Fridolin Somers 2024-04-17 15:04:11 UTC
(In reply to Fridolin Somers from comment #15)
> Error in dependency bug number ?
> It is Bug 34478 "Full CSRF protection" right ?

I fixed it

No backport