Bug 37853 - Returning to your account at the end of changing your password in the OPAC doesn't need to POST a form
Summary: Returning to your account at the end of changing your password in the OPAC do...
Status: Pushed to main
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: Main
Hardware: All All
: P3 normal
Assignee: Phil Ringnalda
QA Contact: Jonathan Druart
URL:
Keywords:
Depends on: 36192
Blocks: 37728
  Show dependency treegraph
 
Reported: 2024-09-05 22:12 UTC by Phil Ringnalda
Modified: 2024-09-13 10:08 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.11.00
Circulation function:


Attachments
Bug 37853: Returning to your account at the end of changing your password in the OPAC doesn't need to POST a form (2.37 KB, patch)
2024-09-05 22:26 UTC, Phil Ringnalda
Details | Diff | Splinter Review
Bug 37853: Returning to your account at the end of changing your password in the OPAC doesn't need to POST a form (2.43 KB, patch)
2024-09-09 12:28 UTC, Olivier V
Details | Diff | Splinter Review
Bug 37853: Do not POST a form at the end of changing the password (OPAC) (2.51 KB, patch)
2024-09-11 13:20 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Phil Ringnalda 2024-09-05 22:12:43 UTC
The end of the UI flow of changing your password in the OPAC is a page which tells you your password was changed (good, you need to know it's time to log out and back in to change your saved password, or that it's time to scribble out the old one on a Post-it and write down the new one), and then offers to take you back to your account with a button in a form which does a POST to opac-user.pl without an op and with your borrowernumber, which is double-bad. We intend not to allow POST without an op, and once the test is fixed in bug 37728 this will fail, and there's no need for the borrowernumber since it will be completely ignored by the script, which will instead get it from your cookie or make you log in.

Instead of a form+button+POST, it should just be a link.
Comment 1 Phil Ringnalda 2024-09-05 22:26:02 UTC
Created attachment 171107 [details] [review]
Bug 37853: Returning to your account at the end of changing your password in the OPAC doesn't need to POST a form

Rather than having a form that does a POST (without an op, which isn't proper),
the final step in changing your password in the OPAC should just be a link.

Test plan:
1. Without the patch applied, log in to the OPAC as a user that you don't
   mind changing the password for
2. Welcome, {username} - Your account - Change password
3. Type the old password, and a new password twice, click Change password
4. Below the success message is a green button with white text, Return to
   my account - click it
5. Apply patch
6. Change password, type the (new) old password, and a (newer) new password
   twice, click Change password
7. Below the success message is what looks like a green button with white
   text, Return to my account
8. Hover the button, check your browser status bar for a URL showing you
   that it's now a link. Click it to be sure it works.

Sponsored-by: Chetco Community Public Library
Comment 2 Olivier V 2024-09-09 12:28:57 UTC
Created attachment 171193 [details] [review]
Bug 37853: Returning to your account at the end of changing your password in the OPAC doesn't need to POST a form

Rather than having a form that does a POST (without an op, which isn't proper),
the final step in changing your password in the OPAC should just be a link.

Test plan:
1. Without the patch applied, log in to the OPAC as a user that you don't
   mind changing the password for
2. Welcome, {username} - Your account - Change password
3. Type the old password, and a new password twice, click Change password
4. Below the success message is a green button with white text, Return to
   my account - click it
5. Apply patch
6. Change password, type the (new) old password, and a (newer) new password
   twice, click Change password
7. Below the success message is what looks like a green button with white
   text, Return to my account
8. Hover the button, check your browser status bar for a URL showing you
   that it's now a link. Click it to be sure it works.

Sponsored-by: Chetco Community Public Library
Signed-off-by: Olivier V <olivier.vezina@inLibro.com>
Comment 3 Jonathan Druart 2024-09-11 13:20:27 UTC
Created attachment 171311 [details] [review]
Bug 37853: Do not POST a form at the end of changing the password (OPAC)

Rather than having a form that does a POST (without an op, which isn't proper),
the final step in changing your password in the OPAC should just be a link.

Test plan:
1. Without the patch applied, log in to the OPAC as a user that you don't
   mind changing the password for
2. Welcome, {username} - Your account - Change password
3. Type the old password, and a new password twice, click Change password
4. Below the success message is a green button with white text, Return to
   my account - click it
5. Apply patch
6. Change password, type the (new) old password, and a (newer) new password
   twice, click Change password
7. Below the success message is what looks like a green button with white
   text, Return to my account
8. Hover the button, check your browser status bar for a URL showing you
   that it's now a link. Click it to be sure it works.

Sponsored-by: Chetco Community Public Library
Signed-off-by: Olivier V <olivier.vezina@inLibro.com>

Amended-by: Jonathan Druart
Edited commit message

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 4 Katrin Fischer 2024-09-13 10:08:16 UTC
Pushed for 24.11!

Well done everyone, thank you!