STEPS TO REPRODUCE: 1 - go to /cgi-bin/koha/tools/letter.pl 2 - click on New notice -> claim serial issue (or any other one) 3 - Fill required fields with random string 4 - Save -> KABOOM
Created attachment 179206 [details] [review] Bug 39317: Fix CSRF protection for letters TEST PLAN: 1 - go to /cgi-bin/koha/tools/letter.pl 2 - click on New notice -> claim serial issue (or any other one) 3 - Fill required fields with random string 4 - Save -> KABOOM 5 - Apply patch 6 - Repeat 1-4 and see it works now
I'm a bit disappointed because the promised Kaboom doesn't appear on every install :'( However there is an issue with the action submitted in post, which is by default the one which lead to the form, and which is incorrect. I'm updating the test plan
Created attachment 179209 [details] [review] Bug 39317: Fix CSRF protection for letters TEST PLAN: 1 - go to /cgi-bin/koha/tools/letter.pl 2 - click on New notice -> claim serial issue (or any other one) 3 - Fill required fields with random string 4 - Save -> if it breaks, go to 5 - Open a network panel (F12 -> network) 6 - Filter on letter.pl 7 - Fill another new notice -> the arguments of the form page have been passed in the address of the POST request. 8 - Apply patch 9 - Repeat the whole process and see it works now
I tried several times, with different browsers, and couldn't get a KABOOM. Hopefully someone else is more lucky!