In Tools -> Comments, the process of approving and un-approving comments is a GET operation. These should be POST'ed with a CSRF token.
Created attachment 167671 [details] [review] Bug 37074: Comment approval and un-approval should be CSRF-protected This patch converts the "Approve" and "Unapprove" controls in the staff client's comment moderation page so that the operations are POST instead of GET. To test, apply the patch and restart services. - If necessary, enable OPACComments and submit a few comments on a few titles in the OPAC - Go to Tools -> Comments - Test the process of approving, unapproving, and deleting comments
Created attachment 167702 [details] [review] Bug 37074: Comment approval and un-approval should be CSRF-protected This patch converts the "Approve" and "Unapprove" controls in the staff client's comment moderation page so that the operations are POST instead of GET. To test, apply the patch and restart services. - If necessary, enable OPACComments and submit a few comments on a few titles in the OPAC - Go to Tools -> Comments - Test the process of approving, unapproving, and deleting comments Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Created attachment 167707 [details] [review] Bug 37074: Comment approval and un-approval should be CSRF-protected This patch converts the "Approve" and "Unapprove" controls in the staff client's comment moderation page so that the operations are POST instead of GET. To test, apply the patch and restart services. - If necessary, enable OPACComments and submit a few comments on a few titles in the OPAC - Go to Tools -> Comments - Test the process of approving, unapproving, and deleting comments Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Created attachment 167708 [details] [review] Bug 37074: Do no pass biblionumber It is not used in the controller Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Patch doesn't apply cleanly for 23.05.x, could this please be rebased?
Hi Wainui, this used cud- from the big CSRF bug, so it doesn't apply beyond 24.05.
(In reply to Katrin Fischer from comment #6) > Hi Wainui, this used cud- from the big CSRF bug, so it doesn't apply beyond > 24.05. Ok, thanks!
This has been backported to 24.05.x-security branch for 24.05.02
Pushed for 24.11! Well done everyone, thank you!
CSRF with "cud-" not backported to 23.11.x