Bug 39317 - Saving a letter template can lead to a CSRF error on some installs
Summary: Saving a letter template can lead to a CSRF error on some installs
Status: Needs Signoff
Alias: None
Product: Koha
Classification: Unclassified
Component: Notices (show other bugs)
Version: Main
Hardware: All All
: P5 - low minor
Assignee: Baptiste Wojtkowski (bwoj)
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-03-12 13:35 UTC by Baptiste Wojtkowski (bwoj)
Modified: 2025-03-29 10:07 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 39317: Fix CSRF protection for letters (1.32 KB, patch)
2025-03-12 13:47 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review
Bug 39317: Fix CSRF protection for letters (1.52 KB, patch)
2025-03-12 14:16 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Baptiste Wojtkowski (bwoj) 2025-03-12 13:35:27 UTC
STEPS TO REPRODUCE:
1 - go to /cgi-bin/koha/tools/letter.pl
2 - click on New notice -> claim serial issue (or any other one)
3 - Fill required fields with random string
4 - Save -> KABOOM
Comment 1 Baptiste Wojtkowski (bwoj) 2025-03-12 13:47:16 UTC
Created attachment 179206 [details] [review]
Bug 39317: Fix CSRF protection for letters

TEST PLAN:
1 - go to /cgi-bin/koha/tools/letter.pl
2 - click on New notice -> claim serial issue (or any other one)
3 - Fill required fields with random string
4 - Save -> KABOOM
5 - Apply patch
6 - Repeat 1-4 and see it works now
Comment 2 Baptiste Wojtkowski (bwoj) 2025-03-12 14:08:52 UTC
I'm a bit disappointed because the promised Kaboom doesn't appear on every install :'(
However there is an issue with the action submitted in post, which is by default the one which lead to the form, and which is incorrect. I'm updating the test plan
Comment 3 Baptiste Wojtkowski (bwoj) 2025-03-12 14:16:31 UTC
Created attachment 179209 [details] [review]
Bug 39317: Fix CSRF protection for letters

TEST PLAN:
1 - go to /cgi-bin/koha/tools/letter.pl
2 - click on New notice -> claim serial issue (or any other one)
3 - Fill required fields with random string
4 - Save -> if it breaks, go to
5 - Open a network panel (F12 -> network)
6 - Filter on letter.pl
7 - Fill another new notice -> the arguments of the form page have been
  passed in the address of the POST request.
8 - Apply patch
9 - Repeat the whole process and see it works now
Comment 4 David Nind 2025-03-29 10:07:28 UTC
I tried several times, with different browsers, and couldn't get a KABOOM.

Hopefully someone else is more lucky!