Bug 38495 - Cannot cancel background job (CSRF)
Summary: Cannot cancel background job (CSRF)
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low major
Assignee: Nick Clemens (kidclamp)
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on: 34478
Blocks:
  Show dependency treegraph
 
Reported: 2024-11-20 13:23 UTC by Nick Clemens (kidclamp)
Modified: 2025-04-18 19:19 UTC (History)
7 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.11.00,24.05.06
Circulation function:


Attachments
Bug 38495: Use JS to submit form to cancel background jobs (2.43 KB, patch)
2024-11-20 13:27 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 38495: Use JS to submit form to cancel background jobs (2.50 KB, patch)
2024-11-20 13:43 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 38495: (follow-up) Add a confirmation message (1.92 KB, patch)
2024-11-20 13:55 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 38495: Use JS to submit form to cancel background jobs (2.59 KB, patch)
2024-11-22 08:01 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 38495: (follow-up) Add a confirmation message (2.06 KB, patch)
2024-11-22 08:01 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens (kidclamp) 2024-11-20 13:23:54 UTC
The operation to cancel a job needs to be cud-cancel and we need to submit as post
Comment 1 Nick Clemens (kidclamp) 2024-11-20 13:27:51 UTC
Created attachment 174841 [details] [review]
Bug 38495: Use JS to submit form to cancel background jobs

This patch adjusts the link to cancel jobs to be submitted as a POST with cud-cancel operation

To test:
1 - Stop your long tasks bacground jobs worker
   sudo koha-worker --stop --queue long_tasks kohadev
2 - Stage a file for import
3 - Administration -> Manage jobs
4 - See your new job
5 - Click 'cancel'
6 - It didn't work
7 - Apply patch
8 - Browse to jobs again
9 - Click 'Cancel'
10 - Job is successfully cancelled
Comment 2 Jonathan Druart 2024-11-20 13:43:44 UTC
Created attachment 174842 [details] [review]
Bug 38495: Use JS to submit form to cancel background jobs

This patch adjusts the link to cancel jobs to be submitted as a POST with cud-cancel operation

To test:
1 - Stop your long tasks bacground jobs worker
   sudo koha-worker --stop --queue long_tasks kohadev
2 - Stage a file for import
3 - Administration -> Manage jobs
4 - See your new job
5 - Click 'cancel'
6 - It didn't work
7 - Apply patch
8 - Browse to jobs again
9 - Click 'Cancel'
10 - Job is successfully cancelled

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 3 Jonathan Druart 2024-11-20 13:44:16 UTC
We are missing a confirmation box.
Comment 4 Nick Clemens (kidclamp) 2024-11-20 13:55:34 UTC
Created attachment 174843 [details] [review]
Bug 38495: (follow-up) Add a confirmation message
Comment 5 Marcel de Rooy 2024-11-22 07:59:50 UTC
Looking here
Comment 6 Marcel de Rooy 2024-11-22 08:01:19 UTC
Created attachment 174910 [details] [review]
Bug 38495: Use JS to submit form to cancel background jobs

This patch adjusts the link to cancel jobs to be submitted as a POST with cud-cancel operation

To test:
1 - Stop your long tasks bacground jobs worker
   sudo koha-worker --stop --queue long_tasks kohadev
2 - Stage a file for import
3 - Administration -> Manage jobs
4 - See your new job
5 - Click 'cancel'
6 - It didn't work
7 - Apply patch
8 - Browse to jobs again
9 - Click 'Cancel'
10 - Job is successfully cancelled

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 7 Marcel de Rooy 2024-11-22 08:01:22 UTC
Created attachment 174911 [details] [review]
Bug 38495: (follow-up) Add a confirmation message

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT} Added a html filter for qa tools..
Comment 8 Marcel de Rooy 2024-11-22 08:02:17 UTC
Moving to major to get RM attention for next release :)
Comment 9 Katrin Fischer 2024-11-22 09:23:51 UTC
Pushed for 24.11!

Well done everyone, thank you!
Comment 10 Lucas Gass (lukeg) 2024-12-05 23:18:24 UTC
Backported to 24.05.x for upcoming 24.05.06
Comment 11 Fridolin Somers 2024-12-18 13:49:30 UTC
Not for 23.11.x
Comment 12 Caroline Cyr La Rose 2025-04-18 19:19:18 UTC
Internal architecture, nothing to add/edit in the manual.