Bug 39527 - Cannot create a new notice when running Koha as a Mojolicious application
Summary: Cannot create a new notice when running Koha as a Mojolicious application
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Tools (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Julian Maurice
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-04-02 13:21 UTC by Julian Maurice
Modified: 2025-05-09 14:49 UTC (History)
2 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 39527: Add action attribute to letter.pl form (1.86 KB, patch)
2025-04-02 13:22 UTC, Julian Maurice
Details | Diff | Splinter Review
Bug 39527: Add action attribute to letter.pl form (1.91 KB, patch)
2025-04-04 16:43 UTC, Magnus Enger
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Julian Maurice 2025-04-02 13:21:13 UTC
When running Koha as a mojolicious application, trying to create a new notice results in a CSRF error, because two different 'op' parameters are sent (one in the URL, one in the POST body)
Comment 1 Julian Maurice 2025-04-02 13:22:03 UTC Comment hidden (obsolete)
Comment 2 Magnus Enger 2025-04-04 16:43:03 UTC
Created attachment 180667 [details] [review]
Bug 39527: Add action attribute to letter.pl form

If not explicitly set, two 'op' parameters are sent, one with the value
in the URL (add_form), one with the value in the form
(cud-add_validate).
This causes an error in the CSRF validation code under Mojolicious
environment.

Test plan:
1. Start staff interface as mojolicious application:
   `bin/intranet daemon -l http://*:3000/`
2. Go to http://localhost:3000 (replace localhost by the hostname where
   koha is running), log in, then go to Tools » Notices and slips.
3. Create a new notice.
   Without the patch it fails with the following message:
    Incorrect use of an unsafe HTTP method with an `op` parameter that
    does not start with "cud-"
   With the patch it should succeed.

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Comment 3 Magnus Enger 2025-04-04 16:46:25 UTC
To test in KTD I did this: 

$ sudo koha-plack --stop kohadev
$ sudo service apache2 stop
$ bin/intranet daemon -l http://*:8081/
Comment 4 Martin Renvoize (ashimema) 2025-05-09 14:49:32 UTC
This was also inadvertently fixed in bug 39317 where we introduced the same change.