Bug 37165 - Can't edit frequencies due to stray cud- in modify op
Summary: Can't edit frequencies due to stray cud- in modify op
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Serials (show other bugs)
Version: Main
Hardware: All All
: P5 - low major
Assignee: Phil Ringnalda
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 36192
  Show dependency tree / graph
 
Reported: 2024-06-22 23:38 UTC by Phil Ringnalda
Modified: 2024-09-10 23:43 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
This fixes the serials frequency edit form so that they can be edited (Serials > Manage frequencies > select edit action for a frequency). Before this, you couldn't edit the frequency - the form was empty. (This is related to the CSRF changes added in Koha 24.05 to improve form security.)
Version(s) released in:
24.11.00,24.05.02
Circulation function:

Attachments
Bug 37165: Can't edit frequencies due to stray cud- in modify op (1.54 KB, patch)
2024-06-22 23:47 UTC, Phil Ringnalda 		Details | Diff | Splinter Review
Bug 37165: Can't edit frequencies due to stray cud- in modify op (1.59 KB, patch)
2024-06-24 16:05 UTC, Brendan Lawlor 		Details | Diff | Splinter Review
Bug 37165: Can't edit frequencies due to stray cud- in modify op (1.65 KB, patch)
2024-06-25 22:50 UTC, Nick Clemens (kidclamp) 		Details | Diff | Splinter Review
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Phil Ringnalda 2024-06-22 23:38:52 UTC 
serials/subscription-frequencies.pl has two modify ops: a POST with cud-savemod changes the frequency, and a GET with modify loads the editing form, except that was changed to cud-modify when it shouldn't have been.
Comment 1 Phil Ringnalda 2024-06-22 23:47:36 UTC 
Created attachment 168006 [details] [review]
Bug 37165: Can't edit frequencies due to stray cud- in modify op

The op modify in subscription-frequencies.pl isn't a cud- operation, it's
a GET of the editing form, so it shouldn't have been changed to cud-modify.

Test plan:
1. Don't apply the patch yet
2. Serials - Manage frequencies - for any frequency click Edit
2. Note that the editing form is empty
3. Apply patch, restart_all
4. Repeat step 2, note that now the editing form has the existing data
5. Change anything, Display order is nice, and save to verify that
   cud-savemod still works
Comment 2 Brendan Lawlor 2024-06-24 16:05:57 UTC 
Created attachment 168026 [details] [review]
Bug 37165: Can't edit frequencies due to stray cud- in modify op

The op modify in subscription-frequencies.pl isn't a cud- operation, it's
a GET of the editing form, so it shouldn't have been changed to cud-modify.

Test plan:
1. Don't apply the patch yet
2. Serials - Manage frequencies - for any frequency click Edit
2. Note that the editing form is empty
3. Apply patch, restart_all
4. Repeat step 2, note that now the editing form has the existing data
5. Change anything, Display order is nice, and save to verify that
   cud-savemod still works

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Comment 3 Nick Clemens (kidclamp) 2024-06-25 22:50:50 UTC 
Created attachment 168111 [details] [review]
Bug 37165: Can't edit frequencies due to stray cud- in modify op

The op modify in subscription-frequencies.pl isn't a cud- operation, it's
a GET of the editing form, so it shouldn't have been changed to cud-modify.

Test plan:
1. Don't apply the patch yet
2. Serials - Manage frequencies - for any frequency click Edit
2. Note that the editing form is empty
3. Apply patch, restart_all
4. Repeat step 2, note that now the editing form has the existing data
5. Change anything, Display order is nice, and save to verify that
   cud-savemod still works

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 4 Katrin Fischer 2024-06-27 09:53:09 UTC 
Pushed for 24.11!

Well done everyone, thank you!
Comment 5 Lucas Gass (lukeg) 2024-07-18 19:57:20 UTC 
Backported to 24.05.x for upcoming 24.05.02
Comment 6 Fridolin Somers 2024-07-19 09:25:19 UTC 
Full CSRF not in 23.11.x
Comment 7 Phil Ringnalda 2024-09-10 23:43:02 UTC 
Nothing to document, just fixed a bug.