Bug 37093 - 403 Forbidden Error when attempting to search for Mana Reports
Summary: 403 Forbidden Error when attempting to search for Mana Reports
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Reports (show other bugs)
Version: 24.05
Hardware: All All
: P5 - low major
Assignee: Phil Ringnalda
QA Contact: Victor Grousset/tuxayo
URL:
Keywords:
Depends on: 36192
Blocks:
  Show dependency treegraph
 
Reported: 2024-06-14 14:56 UTC by Kelly McElligott
Modified: 2024-10-07 19:44 UTC (History)
9 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
This fixes searching for a report in Mana when creating a new report. Searching Mana was generating an error message "Your search could not be completed. Please try again later. 403 Forbidden". (This is related to the CSRF changes added in Koha 24.05 to improve form security.)
Version(s) released in:
24.11.00,24.05.04
Circulation function:


Attachments
Bug 37093: Searching for reports on Mana should use GET (1.92 KB, patch)
2024-07-11 12:52 UTC, Phil Ringnalda
Details | Diff | Splinter Review
Bug 37093: Searching for reports on Mana should use GET (1.97 KB, patch)
2024-07-31 21:38 UTC, David Nind
Details | Diff | Splinter Review
Bug 37093: Searching for reports on Mana should use GET (2.03 KB, patch)
2024-08-01 01:04 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Kelly McElligott 2024-06-14 14:56:47 UTC
We are running 24.05 and have found then when we attempt to search the Mana kb for a report, we are getting a 403 Forbidden Error. 

Steps to reproduce:
1. have mana set up
2. Go to reports, create a new report from mana
3. Use a term to search
4. receive a 403 forbidden error.
Comment 1 Phil Ringnalda 2024-07-07 18:50:04 UTC
That's because your search is sending a POST to /cgi-bin/koha/svc/mana/search without a CSRF token.

https://git.koha-community.org/Koha-community/Koha/src/commit/10853d1edc9c31bcef096ffa514bb3025e0a760e/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt#L2394 is implicitly a POST because it passes an object to .load, but before bug 22250 cleaned things up in https://git.koha-community.org/Koha-community/Koha/commit/679fdaebb1a611859a968f22b85c37fbc00b055b it was explicitly a POST (which bizarrely attempted to include a biblionumber, which makes it look like it was originally poorly-chosen copy-paste).

That line should instead be $("#mana_result_content").load("/cgi-bin/koha/svc/mana/search #mana_results", "resource=report&usecomments=1&id=" + textquery, function( response, status, xhr ) {

That nicely returns results from the search, but were the results ever usable? What I get seems to be the result of replacing newlines with '' rather than with ' ' which garbles everything since it does things like "i.ccodeFROM old_reserves oLEFT JOIN items i" and the SQL parser chokes at oLEFT.
Comment 2 Phil Ringnalda 2024-07-07 22:00:33 UTC
Inconveniently placed line wrapping by Bugzilla, but "result of replacing newlines with nothing, rather than with a single space" is Ye Olde bug 24773.
Comment 3 Phil Ringnalda 2024-07-11 12:52:39 UTC
Created attachment 168809 [details] [review]
Bug 37093: Searching for reports on Mana should use GET

Searching for reports on Mana currently fails by sending a POST to
svc/mana/search without a CSRF token. There's no reason to POST, it's
just sending a search string.

 1. Enable Mana: Reports - lower right is a blue Knowledgebase box with
    a link to Change your Mana KB settings
 2. Switch Use Mana KB to Yes, click Save, below that give it a name and
    email, Send to Mana KB
 3. Reports - Use saved - New report - New SQL from Mana
 4. Enter any keyword to search, get a 403 forbidden error
 5. Apply patch, restart_all, Shift+Reload the page to clear cache
 6. Enter any keyword likely to return results, like select, get results
Comment 4 Phil Ringnalda 2024-07-11 12:56:51 UTC
And once I actually read the line about "Your Mana KB server is currently: https://mana-test.koha-community.org" the broken newline conversion could well be only on the test server, dunno.
Comment 5 David Nind 2024-07-31 21:38:11 UTC
Created attachment 169920 [details] [review]
Bug 37093: Searching for reports on Mana should use GET

Searching for reports on Mana currently fails by sending a POST to
svc/mana/search without a CSRF token. There's no reason to POST, it's
just sending a search string.

 1. Enable Mana: Reports - lower right is a blue Knowledgebase box with
    a link to Change your Mana KB settings
 2. Switch Use Mana KB to Yes, click Save, below that give it a name and
    email, Send to Mana KB
 3. Reports - Use saved - New report - New SQL from Mana
 4. Enter any keyword to search, get a 403 forbidden error
 5. Apply patch, restart_all, Shift+Reload the page to clear cache
 6. Enter any keyword likely to return results, like select, get results

Signed-off-by: David Nind <david@davidnind.com>
Comment 6 Victor Grousset/tuxayo 2024-08-01 01:04:10 UTC
Created attachment 169922 [details] [review]
Bug 37093: Searching for reports on Mana should use GET

Searching for reports on Mana currently fails by sending a POST to
svc/mana/search without a CSRF token. There's no reason to POST, it's
just sending a search string.

 1. Enable Mana: Reports - lower right is a blue Knowledgebase box with
    a link to Change your Mana KB settings
 2. Switch Use Mana KB to Yes, click Save, below that give it a name and
    email, Send to Mana KB
 3. Reports - Use saved - New report - New SQL from Mana
 4. Enter any keyword to search, get a 403 forbidden error
 5. Apply patch, restart_all, Shift+Reload the page to clear cache
 6. Enter any keyword likely to return results, like select, get results

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 7 Victor Grousset/tuxayo 2024-08-01 01:04:19 UTC
Works, makes sense, QA script happy, code looks good, passing QA :)
Comment 8 Katrin Fischer 2024-08-01 16:27:13 UTC
Pushed for 24.11!

Well done everyone, thank you!
Comment 9 CJ Lynce 2024-08-02 20:31:54 UTC
Can this be backported to 24.05? We use mana regularly. Thx!
Comment 10 Lucas Gass (lukeg) 2024-08-29 17:15:13 UTC
Backported to 24.05.x for upcoming 24.05.04
Comment 11 Fridolin Somers 2024-09-16 14:08:25 UTC
Not for 23.11.x