Bug 37794 - Fix form that POSTs without an op in Holds to pull
Summary: Fix form that POSTs without an op in Holds to pull
Status: Needs documenting
Alias: None
Product: Koha
Classification: Unclassified
Component: Circulation (show other bugs)
Version: Main
Hardware: All All
: P3 normal
Assignee: Phil Ringnalda
QA Contact: Testopia
URL:
Keywords:
Depends on: 36192
Blocks: 37728
  Show dependency treegraph
 
Reported: 2024-08-30 17:00 UTC by Phil Ringnalda
Modified: 2024-12-02 09:09 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.11.00,24.05.06
Circulation function:


Attachments
Bug 37794: Fix form that POSTs without an op in Holds to pull (1.76 KB, patch)
2024-08-30 17:09 UTC, Phil Ringnalda
Details | Diff | Splinter Review
Bug 37794: Fix form that POSTs without an op in Holds to pull (1.83 KB, patch)
2024-09-02 13:24 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Phil Ringnalda 2024-08-30 17:00:46 UTC
We intend not to have forms with method="post" without an op variable (so we
can check that the op starts with "cud-" as part of the CSRF protection), but
because of bug 37728 some were missed.

In Holds to pull, that's the form that lets you choose different start and end dates. Having it do a GET instead doesn't add much bookmark or link benefit, since the params are actual dates rather than something like -5d, but at least it lets you refresh the page without a browser warning about repeating a POST.
Comment 1 Phil Ringnalda 2024-08-30 17:09:51 UTC
Created attachment 170922 [details] [review]
Bug 37794: Fix form that POSTs without an op in Holds to pull

We intend not to have forms with method="post" without an op variable (so we
can check that the op starts with "cud-" as part of the CSRF protection), but
because of bug 37728 some were missed.

In Holds to pull that's the form which lets you change from the default
starting and ending date. Switching that to a GET at least lets you refresh
the page without getting a browser warning about resending a POST and maybe
having your credit card double-charged.

Test plan:
1. Without the patch, Circulation - Holds to pull - change the start date to
   something earlier and click Submit
2. Refresh the page, get a warning about resubmitting data
3. Apply patch, Circulation - Holds to pull - change the start date to
   something earlier and click Submit
4. Refresh the page, no warning

Sponsored-by: Chetco Community Public Library
Comment 2 Jonathan Druart 2024-09-02 13:24:49 UTC
Created attachment 170941 [details] [review]
Bug 37794: Fix form that POSTs without an op in Holds to pull

We intend not to have forms with method="post" without an op variable (so we
can check that the op starts with "cud-" as part of the CSRF protection), but
because of bug 37728 some were missed.

In Holds to pull that's the form which lets you change from the default
starting and ending date. Switching that to a GET at least lets you refresh
the page without getting a browser warning about resending a POST and maybe
having your credit card double-charged.

Test plan:
1. Without the patch, Circulation - Holds to pull - change the start date to
   something earlier and click Submit
2. Refresh the page, get a warning about resubmitting data
3. Apply patch, Circulation - Holds to pull - change the start date to
   something earlier and click Submit
4. Refresh the page, no warning

Sponsored-by: Chetco Community Public Library

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 3 Jonathan Druart 2024-09-02 13:25:12 UTC
Trivial, skipping QA.

Bugfix and definitely an improvement (having the filters in the URL!)
Comment 4 Katrin Fischer 2024-09-02 14:37:11 UTC
Pushed for 24.11!

Well done everyone, thank you!
Comment 5 Lucas Gass (lukeg) 2024-11-15 21:01:33 UTC
Backported to 24.05.x for upcoming 24.05.06
Comment 6 Fridolin Somers 2024-12-02 09:09:53 UTC
Not for 23.11.x