Bug 37779 - Fix forms that POST without an op in tag moderation
Summary: Fix forms that POST without an op in tag moderation
Status: Pushed to main
Alias: None
Product: Koha
Classification: Unclassified
Component: Tools (show other bugs)
Version: Main
Hardware: All All
: P3 normal
Assignee: Phil Ringnalda
QA Contact: Testopia
URL:
Keywords:
Depends on: 36192
Blocks: 37728
  Show dependency treegraph
 
Reported: 2024-08-29 16:57 UTC by Phil Ringnalda
Modified: 2024-09-13 10:07 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.11.00
Circulation function:


Attachments
Bug 37779: Fix forms that POST without an op in tag moderation (4.72 KB, patch)
2024-08-30 16:46 UTC, Phil Ringnalda
Details | Diff | Splinter Review
Bug 37779: Fix forms that POST without an op in tag moderation (4.79 KB, patch)
2024-09-09 15:49 UTC, Sukhmandeep
Details | Diff | Splinter Review
Bug 37779: Fix forms that POST without an op in tag moderation (4.86 KB, patch)
2024-09-11 13:54 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Phil Ringnalda 2024-08-29 16:57:36 UTC
We intend not to have forms with method="post" without an op variable (so we
can check that the op starts with "cud-" as part of the CSRF protection), but
because of bug 37728 some were missed.

In tag moderation, there are two: the fallback form for testing whether a word has been approved or rejected when JavaScript is disabled so the normal AJAX code doesn't run (a brutal thing to write a test plan for), and the Filters form, which by POSTing prevents you from bookmarking the page for all reviews by a particular person, or all rejected tags, or anything else you might want to check without having to recreate the filter.
Comment 1 Phil Ringnalda 2024-08-30 06:22:19 UTC
Luckily, the no-JS fallback for test has only been broken for seven months, since a bug 34478 commit gave tags/review.pl actual op params with values to replace the params with names like "op-test" and a throwaway value that it used before, without noticing the submit button with the name op-test.
Comment 2 Phil Ringnalda 2024-08-30 16:46:34 UTC
Created attachment 170919 [details] [review]
Bug 37779: Fix forms that POST without an op in tag moderation

We intend not to have forms with method="post" without an op variable (so we
can check that the op starts with "cud-" as part of the CSRF protection), but
because of bug 37728 some were missed.

There are two in tags/review.tt: the filters for term, status, reviewer, and
dates, which are better as a GET since you can then bookmark and link to a
particular set of filters, and the no-JavaScript fallback for checking whether
a term has been approved or rejected, which currently doesn't work at all,
but with a working op param then works just fine as a GET.

Test plan:

If you have to use Chrome, you're on your own for the disabling JavaScript
and getting rid of the body {display: none !important} style rule, my plan
uses Firefox's devtools to do it

 1. Without the patch, Tools - Tags - change the filter from the default
    status "pending" to "all", Apply, and bookmark the page
 2. Open your bookmark, note that it's status "pending"
 3. You can't test the no-JS fallback for term testing since it doesn't
    work, so apply patch and restart_all
 4. Tools - Tags - change the filter from the default status "pending"
    to "all", Apply, and bookmark the page
 5. Open your bookmark, note that it's status "all"
 6. You need a couple of tags to test the Test feature, so open the OPAC,
    log in, search for any record and add the tags approveme, rejectme
 7. Back in Tools - Tags, click the Reject button to reject rejectme
 8. In the Check lists input, test that approveme shows "approveme is
    permitted!" and rejectme shows "rejectme is prohibited!"
 8. Now to disable JavaScript, open Firefox's More tools - Web Developer
    Tools. You're going to need the Style Editor, so if it's not visible
    you'll want to enable it in Settings in the next step
 9. Top bar, right side, there's a three-dots menu, with an option for
    Settings. In Advanced settings, click the checkbox for Disable JavaScript
    (which as hovering the * says, is only for that tab and only until you
    close the tab or the toolbox).
10. Checking Disable JavaScript turned your page to blank white, so go to
    the Style Editor, where the first thing, already selected, is an inline
    style sheet with the rule "body {display: none !important}" - select all
    the text of the rule and delete it, which you'll have to do on every
    page load
11. In the Check lists input, test that approveme still shows "approveme
    is permitted!" (after you delete the display: none !important rule, and
    with a rather annoying message about "Tested 1 Term(s)." replacing the
    list of terms).

Sponsored-by: Chetco Community Public Library
Comment 3 Sukhmandeep 2024-09-09 15:49:13 UTC
Created attachment 171214 [details] [review]
Bug 37779: Fix forms that POST without an op in tag moderation

We intend not to have forms with method="post" without an op variable (so we
can check that the op starts with "cud-" as part of the CSRF protection), but
because of bug 37728 some were missed.

There are two in tags/review.tt: the filters for term, status, reviewer, and
dates, which are better as a GET since you can then bookmark and link to a
particular set of filters, and the no-JavaScript fallback for checking whether
a term has been approved or rejected, which currently doesn't work at all,
but with a working op param then works just fine as a GET.

Test plan:

If you have to use Chrome, you're on your own for the disabling JavaScript
and getting rid of the body {display: none !important} style rule, my plan
uses Firefox's devtools to do it

 1. Without the patch, Tools - Tags - change the filter from the default
    status "pending" to "all", Apply, and bookmark the page
 2. Open your bookmark, note that it's status "pending"
 3. You can't test the no-JS fallback for term testing since it doesn't
    work, so apply patch and restart_all
 4. Tools - Tags - change the filter from the default status "pending"
    to "all", Apply, and bookmark the page
 5. Open your bookmark, note that it's status "all"
 6. You need a couple of tags to test the Test feature, so open the OPAC,
    log in, search for any record and add the tags approveme, rejectme
 7. Back in Tools - Tags, click the Reject button to reject rejectme
 8. In the Check lists input, test that approveme shows "approveme is
    permitted!" and rejectme shows "rejectme is prohibited!"
 8. Now to disable JavaScript, open Firefox's More tools - Web Developer
    Tools. You're going to need the Style Editor, so if it's not visible
    you'll want to enable it in Settings in the next step
 9. Top bar, right side, there's a three-dots menu, with an option for
    Settings. In Advanced settings, click the checkbox for Disable JavaScript
    (which as hovering the * says, is only for that tab and only until you
    close the tab or the toolbox).
10. Checking Disable JavaScript turned your page to blank white, so go to
    the Style Editor, where the first thing, already selected, is an inline
    style sheet with the rule "body {display: none !important}" - select all
    the text of the rule and delete it, which you'll have to do on every
    page load
11. In the Check lists input, test that approveme still shows "approveme
    is permitted!" (after you delete the display: none !important rule, and
    with a rather annoying message about "Tested 1 Term(s)." replacing the
    list of terms).

Sponsored-by: Chetco Community Public Library
Signed-off-by: Sukhmandeep Benipal <sukhmandeep.benipal@inLibro.com>
Comment 4 Jonathan Druart 2024-09-11 13:54:15 UTC
Created attachment 171333 [details] [review]
Bug 37779: Fix forms that POST without an op in tag moderation

We intend not to have forms with method="post" without an op variable (so we
can check that the op starts with "cud-" as part of the CSRF protection), but
because of bug 37728 some were missed.

There are two in tags/review.tt: the filters for term, status, reviewer, and
dates, which are better as a GET since you can then bookmark and link to a
particular set of filters, and the no-JavaScript fallback for checking whether
a term has been approved or rejected, which currently doesn't work at all,
but with a working op param then works just fine as a GET.

Test plan:

If you have to use Chrome, you're on your own for the disabling JavaScript
and getting rid of the body {display: none !important} style rule, my plan
uses Firefox's devtools to do it

 1. Without the patch, Tools - Tags - change the filter from the default
    status "pending" to "all", Apply, and bookmark the page
 2. Open your bookmark, note that it's status "pending"
 3. You can't test the no-JS fallback for term testing since it doesn't
    work, so apply patch and restart_all
 4. Tools - Tags - change the filter from the default status "pending"
    to "all", Apply, and bookmark the page
 5. Open your bookmark, note that it's status "all"
 6. You need a couple of tags to test the Test feature, so open the OPAC,
    log in, search for any record and add the tags approveme, rejectme
 7. Back in Tools - Tags, click the Reject button to reject rejectme
 8. In the Check lists input, test that approveme shows "approveme is
    permitted!" and rejectme shows "rejectme is prohibited!"
 8. Now to disable JavaScript, open Firefox's More tools - Web Developer
    Tools. You're going to need the Style Editor, so if it's not visible
    you'll want to enable it in Settings in the next step
 9. Top bar, right side, there's a three-dots menu, with an option for
    Settings. In Advanced settings, click the checkbox for Disable JavaScript
    (which as hovering the * says, is only for that tab and only until you
    close the tab or the toolbox).
10. Checking Disable JavaScript turned your page to blank white, so go to
    the Style Editor, where the first thing, already selected, is an inline
    style sheet with the rule "body {display: none !important}" - select all
    the text of the rule and delete it, which you'll have to do on every
    page load
11. In the Check lists input, test that approveme still shows "approveme
    is permitted!" (after you delete the display: none !important rule, and
    with a rather annoying message about "Tested 1 Term(s)." replacing the
    list of terms).

Sponsored-by: Chetco Community Public Library
Signed-off-by: Sukhmandeep Benipal <sukhmandeep.benipal@inLibro.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 5 Katrin Fischer 2024-09-13 10:07:51 UTC
Pushed for 24.11!

Well done everyone, thank you!