Bug 38309 - Cannot delete additional fields
Summary: Cannot delete additional fields
Status: Pushed to main
Alias: None
Product: Koha
Classification: Unclassified
Component: System Administration (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Phil Ringnalda
QA Contact: Lucas Gass (lukeg)
URL:
Keywords:
Depends on: 36192
Blocks:
  Show dependency tree / graph
 
Reported: 2024-10-31 12:30 UTC by Nick Clemens (kidclamp)
Modified: 2024-11-07 22:34 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
This fixes deleting additional fields (Administration - Additional parameters > Additional fields) - deleting fields now works as expected. Previously, attempting to delete a field would generate a blank page and the field was not deleted. (This is related to the CSRF changes added in Koha 24.05 to improve form security.)
Version(s) released in:
24.11.00
Circulation function:

Attachments
Bug 38309: Cannot delete additional fields (3.00 KB, patch)
2024-11-01 02:52 UTC, Phil Ringnalda 		Details | Diff | Splinter Review
Bug 38309: Cannot delete additional fields (3.05 KB, patch)
2024-11-01 08:44 UTC, David Nind 		Details | Diff | Splinter Review
Bug 38309: Cannot delete additional fields (3.11 KB, patch)
2024-11-01 17:56 UTC, Lucas Gass (lukeg) 		Details | Diff | Splinter Review
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens (kidclamp) 2024-10-31 12:30:08 UTC 
To recreate:
1 - Browse to Administration->Additional fields
2 - Click 'Invoices (aqinvoices)'
3 - Click 'New field'
4 - Fill out form and save
5 - See the new fiellisted
6 - Click 'Delete', confirm
7 - Screen goes blank
8 - Try to click 'Additional fields' in breadcrumb, no action
9 - Click 'Administration' in breadcrums
10 - Go to Additional fields->Invoices
11 - Your field is still there
Comment 1 Phil Ringnalda 2024-11-01 02:01:49 UTC 
Neat, we still have '.pl?op=delete' after all this time.
Comment 2 Phil Ringnalda 2024-11-01 02:52:43 UTC 
Created attachment 173851 [details] [review]
Bug 38309: Cannot delete additional fields

Deleting an additional field tries to do a GET of ?op=delete... which no
longer works with CSRF protection. It needs to be a POST with op=cud-delete.

Test plan:
 1. Administration - Additional fields, click any table name
 2. New field, fill in a name and Save
 3. In the row for your field, click Delete
 4. You have a blank page
 5. Apply patch, click the browser Back button, refresh the page
 6. In the row for your undeleted field, click Delete
 7. Your field is deleted

Sponsored-by: Chetco Community Public Library
Comment 3 David Nind 2024-11-01 08:44:12 UTC 
Created attachment 173858 [details] [review]
Bug 38309: Cannot delete additional fields

Deleting an additional field tries to do a GET of ?op=delete... which no
longer works with CSRF protection. It needs to be a POST with op=cud-delete.

Test plan:
 1. Administration - Additional fields, click any table name
 2. New field, fill in a name and Save
 3. In the row for your field, click Delete
 4. You have a blank page
 5. Apply patch, click the browser Back button, refresh the page
 6. In the row for your undeleted field, click Delete
 7. Your field is deleted

Sponsored-by: Chetco Community Public Library
Signed-off-by: David Nind <david@davidnind.com>
Comment 4 Lucas Gass (lukeg) 2024-11-01 17:54:26 UTC 
Good to see use of js/form-submit.js here.
Comment 5 Lucas Gass (lukeg) 2024-11-01 17:56:26 UTC 
Created attachment 173885 [details] [review]
Bug 38309: Cannot delete additional fields

Deleting an additional field tries to do a GET of ?op=delete... which no
longer works with CSRF protection. It needs to be a POST with op=cud-delete.

Test plan:
 1. Administration - Additional fields, click any table name
 2. New field, fill in a name and Save
 3. In the row for your field, click Delete
 4. You have a blank page
 5. Apply patch, click the browser Back button, refresh the page
 6. In the row for your undeleted field, click Delete
 7. Your field is deleted

Sponsored-by: Chetco Community Public Library
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Comment 6 Katrin Fischer 2024-11-07 16:33:57 UTC 
Pushed for 24.11!

Well done everyone, thank you!