Bug 36414 - Consequent workflow stages form submit fail due to CSRF token conflict
Summary: Consequent workflow stages form submit fail due to CSRF token conflict
Status: Needs Signoff
Alias: None
Product: Koha
Classification: Unclassified
Component: ILL (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Pedro Amorim
QA Contact:
URL:
Keywords:
Depends on:
Blocks: 36192
  Show dependency treegraph
 
Reported: 2024-03-25 10:21 UTC by Pedro Amorim
Modified: 2024-04-03 14:27 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 36414: Staff UI - Skip csrf_token (2.09 KB, patch)
2024-03-25 10:33 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36414: OPAC - Skip csrf_token (3.14 KB, patch)
2024-03-25 10:33 UTC, Pedro Amorim
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Pedro Amorim 2024-03-25 10:21:35 UTC

    
Comment 1 Pedro Amorim 2024-03-25 10:33:07 UTC
Created attachment 163785 [details] [review]
Bug 36414: Staff UI - Skip csrf_token

Skip csrf_token field if it already exists and
is coming from a previous workflow stage form
submission, as it's already included at the
start of the form.
Comment 2 Pedro Amorim 2024-03-25 10:33:09 UTC
Created attachment 163786 [details] [review]
Bug 36414: OPAC - Skip csrf_token

Skip csrf_token field if it already exists and
is coming from a previous workflow stage form
submission, as it's already included at the
start of the form.

The test plan requires EDS credentials in order to be followed.
I'm available to help others through this test plan if required.
Otherwise, I believe the code is simple enough to understand
and follow what it's fixing without testing.

Test plan:
1) Install an ILL availabililty plugin, e.g.:
https://github.com/PTFS-Europe/koha-plugin-ill-avail-eds
3) Configure the plugin and add EDS credentials
4) Enable ILLCheckAvailability sys pref
5) Enable ILLModuleDisclaimerByType by copying the example YAML block in the sys pref description
6) Create a new ILL request of type 'Book' and add a DOI
7) You should now be on the availabililty stage, click 'Continue adding your request'
8) You should now be on the type disclaimer stage, click 'Create'
9) Notice 'Wrong CSRF token' error.
This happens because the type disclaimer stage is adding its own CSRF token in addition
to the CSRF token coming from the previous availabililty stage
10) Apply patch. Repeat. No error -> Request is created as expected.
11) Do the same test plan on both Staff UI and OPAC