Bug 37039 - Cannot request a discharge in the OPAC
Summary: Cannot request a discharge in the OPAC
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: Main
Hardware: All All
: P5 - low major
Assignee: Owen Leonard
QA Contact: Julian Maurice
URL:
Keywords:
Depends on: 34478
Blocks:
  Show dependency treegraph
 
Reported: 2024-06-05 18:04 UTC by Owen Leonard
Modified: 2024-08-01 14:41 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
This fixes the OPAC discharge request so that it now works as expected - after pressing the "Ask for a discharge" button, the page was refreshed but no request was made. (Requires useDischarge system preference enabled; OPAC > Your account > Ask for a discharge.) (This is related to the CSRF changes added in Koha 24.05 to improve form security.)
Version(s) released in:
24.11.00,24.05.02
Circulation function:


Attachments
Bug 37039: Update discharge request with CSRF token (1.99 KB, patch)
2024-06-05 18:11 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 37039: Update discharge request with CSRF token (2.04 KB, patch)
2024-06-05 20:18 UTC, David Nind
Details | Diff | Splinter Review
Bug 37039: Update discharge request with CSRF token (2.10 KB, patch)
2024-06-07 13:07 UTC, Julian Maurice
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Owen Leonard 2024-06-05 18:04:42 UTC
The page needs to be updated with a valid CSRF form.
Comment 1 Owen Leonard 2024-06-05 18:11:11 UTC
Created attachment 167490 [details] [review]
Bug 37039: Update discharge request with CSRF token

The OPAC discharge page used a link with a GET parameter, but the script
expects a POST request. This patch converts the link to a form with CSRF
token included.

To test, apply the patch and enable the useDischarge system preference
if necessary.

- Log in to the OPAC as a user with no checkouts or outstanding fees.
- Click the "Ask for discharge" tab in the sidebar of the user summary
  page.
- Click the "Ask for a discharge" button.
- You should be redirected to a page that says "Your discharge request
  has been sent."
Comment 2 David Nind 2024-06-05 20:18:10 UTC
Created attachment 167497 [details] [review]
Bug 37039: Update discharge request with CSRF token

The OPAC discharge page used a link with a GET parameter, but the script
expects a POST request. This patch converts the link to a form with CSRF
token included.

To test, apply the patch and enable the useDischarge system preference
if necessary.

- Log in to the OPAC as a user with no checkouts or outstanding fees.
- Click the "Ask for discharge" tab in the sidebar of the user summary
  page.
- Click the "Ask for a discharge" button.
- You should be redirected to a page that says "Your discharge request
  has been sent."

Signed-off-by: David Nind <david@davidnind.com>
Comment 3 Julian Maurice 2024-06-07 13:07:04 UTC
Created attachment 167575 [details] [review]
Bug 37039: Update discharge request with CSRF token

The OPAC discharge page used a link with a GET parameter, but the script
expects a POST request. This patch converts the link to a form with CSRF
token included.

To test, apply the patch and enable the useDischarge system preference
if necessary.

- Log in to the OPAC as a user with no checkouts or outstanding fees.
- Click the "Ask for discharge" tab in the sidebar of the user summary
  page.
- Click the "Ask for a discharge" button.
- You should be redirected to a page that says "Your discharge request
  has been sent."

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Comment 4 Martin Renvoize (ashimema) 2024-06-10 11:04:09 UTC
Thanks for all the hard work!

Pushed to main for the next 24.11.00 release as RM Assistant
Comment 5 Lucas Gass (lukeg) 2024-06-27 21:54:28 UTC
Backported to 24.05.x for upcoming 24.05.02
Comment 6 Fridolin Somers 2024-07-17 13:15:36 UTC
Depends on Bug 34478 not in 23.11.x
Comment 7 David Nind 2024-08-01 14:41:57 UTC
No change required to the manual - fixes something not working. No changes to screenshots in the OAPC section required.