Bug 39527 - Cannot create a new notice when running Koha as a Mojolicious application
Summary: Cannot create a new notice when running Koha as a Mojolicious application
Status: Needs Signoff
Alias: None
Product: Koha
Classification: Unclassified
Component: Tools (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Julian Maurice
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-04-02 13:21 UTC by Julian Maurice
Modified: 2025-04-02 13:22 UTC (History)
0 users

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 39527: Add action attribute to letter.pl form (1.86 KB, patch)
2025-04-02 13:22 UTC, Julian Maurice
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Julian Maurice 2025-04-02 13:21:13 UTC
When running Koha as a mojolicious application, trying to create a new notice results in a CSRF error, because two different 'op' parameters are sent (one in the URL, one in the POST body)
Comment 1 Julian Maurice 2025-04-02 13:22:03 UTC
Created attachment 180348 [details] [review]
Bug 39527: Add action attribute to letter.pl form

If not explicitly set, two 'op' parameters are sent, one with the value
in the URL (add_form), one with the value in the form
(cud-add_validate).
This causes an error in the CSRF validation code under Mojolicious
environment.

Test plan:
1. Start staff interface as mojolicious application:
   `bin/intranet daemon -l http://*:3000/`
2. Go to http://localhost:3000 (replace localhost by the hostname where
   koha is running), log in, then go to Tools ยป Notices and slips.
3. Create a new notice.
   Without the patch it fails with the following message:
    Incorrect use of an unsafe HTTP method with an `op` parameter that
    does not start with "cud-"
   With the patch it should succeed.