Bug 39570 - Add item form includes itemnumber while adding a new item
Summary: Add item form includes itemnumber while adding a new item
Status: Pushed to main
Alias: None
Product: Koha
Classification: Unclassified
Component: Cataloging (show other bugs)
Version: Main
Hardware: All All
: P5 - low minor
Assignee: Phil Ringnalda
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on: 36192
Blocks:
  Show dependency treegraph
 
Reported: 2025-04-04 18:46 UTC by Phil Ringnalda
Modified: 2025-04-14 06:53 UTC (History)
1 user (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
25.05.00
Circulation function:


Attachments
Bug 39570: Add item form includes itemnumber while adding a new item (2.29 KB, patch)
2025-04-04 20:47 UTC, Phil Ringnalda
Details | Diff | Splinter Review
Bug 39570: Add item form includes itemnumber while adding a new item (2.35 KB, patch)
2025-04-08 00:47 UTC, Brendan Gallagher
Details | Diff | Splinter Review
Bug 39570: Add item form includes itemnumber while adding a new item (2.45 KB, patch)
2025-04-11 07:20 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Phil Ringnalda 2025-04-04 18:46:49 UTC
Luckily, submitting an itemnumber that's either empty or bogus while adding a new item doesn't actually do anything since the code for op == 'cud-additem' doesn't ever look at itemnumber, but it's confusing and scary looking in the case where you add an item after editing an existing item.

The template looks at [% IF op != 'add_item' %] to decide to add the <input type="hidden" name="itemnumber" value="[% itemnumber | html %]" />.

Prior to the bug 36192 CSRF protection, that worked, but now the op for adding an item is cud-additem, so it's always true and we always submit an itemnumber. And without bug 27625 it would have been less scary looking, since before then while processing the editing of an item we cleared $itemnumber after we were done using it, so it at least would have been value="". Now, if you edit an existing item and then add another, the form you submit to add an item includes the itemnumber of the item you previously edited.
Comment 1 Phil Ringnalda 2025-04-04 20:47:44 UTC
Created attachment 180682 [details] [review]
Bug 39570: Add item form includes itemnumber while adding a new item

Because the template uses the wrong op, add_item rather than cud-additem, to
decide whether to include a hidden input with the itemnumber, if you edit an
item and then add another item you wind up submitting a form that includes the
previous itemnumber when you add a new one. Nothing happens, because the code
for adding an item doesn't look at $input->param('itemnumber'), but since it
doesn't mean anything we shouldn't be submitting it.

Test plan:
1. Without the patch, find any biblio with at least one item attached, and
   in the items table click Edit item on one of them
2. Without needing to making any changes, click Save changes
3. In the page that loads, scroll down to the bottom of the Add item form,
   right-click the Add item button, and choose Inspect
4. A few lines up, above a '<fieldset class="action">,' there will be an
   '<input type="hidden" name="itemnumber" value="633">' with the itemnumber
   of the item you previously edited
5. Apply patch
6. Scroll up, click Actions - Edit on any item, then Save changes
7. Again, right-click the Add item button, Inspect, note that there isn't a
   itemnumber input with the number of the item you previously edited

Sponsored-by: Chetco Community Public Library
Comment 2 Brendan Gallagher 2025-04-08 00:47:44 UTC
Created attachment 180713 [details] [review]
Bug 39570: Add item form includes itemnumber while adding a new item

Because the template uses the wrong op, add_item rather than cud-additem, to
decide whether to include a hidden input with the itemnumber, if you edit an
item and then add another item you wind up submitting a form that includes the
previous itemnumber when you add a new one. Nothing happens, because the code
for adding an item doesn't look at $input->param('itemnumber'), but since it
doesn't mean anything we shouldn't be submitting it.

Test plan:
1. Without the patch, find any biblio with at least one item attached, and
   in the items table click Edit item on one of them
2. Without needing to making any changes, click Save changes
3. In the page that loads, scroll down to the bottom of the Add item form,
   right-click the Add item button, and choose Inspect
4. A few lines up, above a '<fieldset class="action">,' there will be an
   '<input type="hidden" name="itemnumber" value="633">' with the itemnumber
   of the item you previously edited
5. Apply patch
6. Scroll up, click Actions - Edit on any item, then Save changes
7. Again, right-click the Add item button, Inspect, note that there isn't a
   itemnumber input with the number of the item you previously edited

Sponsored-by: Chetco Community Public Library
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Comment 3 Marcel de Rooy 2025-04-11 07:20:07 UTC
Created attachment 180814 [details] [review]
Bug 39570: Add item form includes itemnumber while adding a new item

Because the template uses the wrong op, add_item rather than cud-additem, to
decide whether to include a hidden input with the itemnumber, if you edit an
item and then add another item you wind up submitting a form that includes the
previous itemnumber when you add a new one. Nothing happens, because the code
for adding an item doesn't look at $input->param('itemnumber'), but since it
doesn't mean anything we shouldn't be submitting it.

Test plan:
1. Without the patch, find any biblio with at least one item attached, and
   in the items table click Edit item on one of them
2. Without needing to making any changes, click Save changes
3. In the page that loads, scroll down to the bottom of the Add item form,
   right-click the Add item button, and choose Inspect
4. A few lines up, above a '<fieldset class="action">,' there will be an
   '<input type="hidden" name="itemnumber" value="633">' with the itemnumber
   of the item you previously edited
5. Apply patch
6. Scroll up, click Actions - Edit on any item, then Save changes
7. Again, right-click the Add item button, Inspect, note that there isn't a
   itemnumber input with the number of the item you previously edited

Sponsored-by: Chetco Community Public Library
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 4 Katrin Fischer 2025-04-14 06:53:05 UTC
Pushed for 25.05!

Well done everyone, thank you!