That's because your search is sending a POST to /cgi-bin/koha/svc/mana/search without a CSRF token.

https://git.koha-community.org/Koha-community/Koha/src/commit/10853d1edc9c31bcef096ffa514bb3025e0a760e/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt#L2394 is implicitly a POST because it passes an object to .load, but before bug 22250 cleaned things up in https://git.koha-community.org/Koha-community/Koha/commit/679fdaebb1a611859a968f22b85c37fbc00b055b it was explicitly a POST (which bizarrely attempted to include a biblionumber, which makes it look like it was originally poorly-chosen copy-paste).

That line should instead be $("#mana_result_content").load("/cgi-bin/koha/svc/mana/search #mana_results", "resource=report&usecomments=1&id=" + textquery, function( response, status, xhr ) {

That nicely returns results from the search, but were the results ever usable? What I get seems to be the result of replacing newlines with '' rather than with ' ' which garbles everything since it does things like "i.ccodeFROM old_reserves oLEFT JOIN items i" and the SQL parser chokes at oLEFT.

Inconveniently placed line wrapping by Bugzilla, but "result of replacing newlines with nothing, rather than with a single space" is Ye Olde bug 24773.

Created attachment 168809 [details] [review]
Bug 37093: Searching for reports on Mana should use GET

Searching for reports on Mana currently fails by sending a POST to
svc/mana/search without a CSRF token. There's no reason to POST, it's
just sending a search string.

 1. Enable Mana: Reports - lower right is a blue Knowledgebase box with
    a link to Change your Mana KB settings
 2. Switch Use Mana KB to Yes, click Save, below that give it a name and
    email, Send to Mana KB
 3. Reports - Use saved - New report - New SQL from Mana
 4. Enter any keyword to search, get a 403 forbidden error
 5. Apply patch, restart_all, Shift+Reload the page to clear cache
 6. Enter any keyword likely to return results, like select, get results

And once I actually read the line about "Your Mana KB server is currently: https://mana-test.koha-community.org" the broken newline conversion could well be only on the test server, dunno.

Created attachment 169920 [details] [review]
Bug 37093: Searching for reports on Mana should use GET

Searching for reports on Mana currently fails by sending a POST to
svc/mana/search without a CSRF token. There's no reason to POST, it's
just sending a search string.

 1. Enable Mana: Reports - lower right is a blue Knowledgebase box with
    a link to Change your Mana KB settings
 2. Switch Use Mana KB to Yes, click Save, below that give it a name and
    email, Send to Mana KB
 3. Reports - Use saved - New report - New SQL from Mana
 4. Enter any keyword to search, get a 403 forbidden error
 5. Apply patch, restart_all, Shift+Reload the page to clear cache
 6. Enter any keyword likely to return results, like select, get results

Signed-off-by: David Nind <david@davidnind.com>

Created attachment 169922 [details] [review]
Bug 37093: Searching for reports on Mana should use GET

Searching for reports on Mana currently fails by sending a POST to
svc/mana/search without a CSRF token. There's no reason to POST, it's
just sending a search string.

 1. Enable Mana: Reports - lower right is a blue Knowledgebase box with
    a link to Change your Mana KB settings
 2. Switch Use Mana KB to Yes, click Save, below that give it a name and
    email, Send to Mana KB
 3. Reports - Use saved - New report - New SQL from Mana
 4. Enter any keyword to search, get a 403 forbidden error
 5. Apply patch, restart_all, Shift+Reload the page to clear cache
 6. Enter any keyword likely to return results, like select, get results

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Works, makes sense, QA script happy, code looks good, passing QA :)

Pushed for 24.11!

Well done everyone, thank you!

Can this be backported to 24.05? We use mana regularly. Thx!

Backported to 24.05.x for upcoming 24.05.04

Not for 23.11.x