Luckily, submitting an itemnumber that's either empty or bogus while adding a new item doesn't actually do anything since the code for op == 'cud-additem' doesn't ever look at itemnumber, but it's confusing and scary looking in the case where you add an item after editing an existing item. The template looks at [% IF op != 'add_item' %] to decide to add the <input type="hidden" name="itemnumber" value="[% itemnumber | html %]" />. Prior to the bug 36192 CSRF protection, that worked, but now the op for adding an item is cud-additem, so it's always true and we always submit an itemnumber. And without bug 27625 it would have been less scary looking, since before then while processing the editing of an item we cleared $itemnumber after we were done using it, so it at least would have been value="". Now, if you edit an existing item and then add another, the form you submit to add an item includes the itemnumber of the item you previously edited.
Created attachment 180682 [details] [review] Bug 39570: Add item form includes itemnumber while adding a new item Because the template uses the wrong op, add_item rather than cud-additem, to decide whether to include a hidden input with the itemnumber, if you edit an item and then add another item you wind up submitting a form that includes the previous itemnumber when you add a new one. Nothing happens, because the code for adding an item doesn't look at $input->param('itemnumber'), but since it doesn't mean anything we shouldn't be submitting it. Test plan: 1. Without the patch, find any biblio with at least one item attached, and in the items table click Edit item on one of them 2. Without needing to making any changes, click Save changes 3. In the page that loads, scroll down to the bottom of the Add item form, right-click the Add item button, and choose Inspect 4. A few lines up, above a '<fieldset class="action">,' there will be an '<input type="hidden" name="itemnumber" value="633">' with the itemnumber of the item you previously edited 5. Apply patch 6. Scroll up, click Actions - Edit on any item, then Save changes 7. Again, right-click the Add item button, Inspect, note that there isn't a itemnumber input with the number of the item you previously edited Sponsored-by: Chetco Community Public Library
Created attachment 180713 [details] [review] Bug 39570: Add item form includes itemnumber while adding a new item Because the template uses the wrong op, add_item rather than cud-additem, to decide whether to include a hidden input with the itemnumber, if you edit an item and then add another item you wind up submitting a form that includes the previous itemnumber when you add a new one. Nothing happens, because the code for adding an item doesn't look at $input->param('itemnumber'), but since it doesn't mean anything we shouldn't be submitting it. Test plan: 1. Without the patch, find any biblio with at least one item attached, and in the items table click Edit item on one of them 2. Without needing to making any changes, click Save changes 3. In the page that loads, scroll down to the bottom of the Add item form, right-click the Add item button, and choose Inspect 4. A few lines up, above a '<fieldset class="action">,' there will be an '<input type="hidden" name="itemnumber" value="633">' with the itemnumber of the item you previously edited 5. Apply patch 6. Scroll up, click Actions - Edit on any item, then Save changes 7. Again, right-click the Add item button, Inspect, note that there isn't a itemnumber input with the number of the item you previously edited Sponsored-by: Chetco Community Public Library Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Created attachment 180814 [details] [review] Bug 39570: Add item form includes itemnumber while adding a new item Because the template uses the wrong op, add_item rather than cud-additem, to decide whether to include a hidden input with the itemnumber, if you edit an item and then add another item you wind up submitting a form that includes the previous itemnumber when you add a new one. Nothing happens, because the code for adding an item doesn't look at $input->param('itemnumber'), but since it doesn't mean anything we shouldn't be submitting it. Test plan: 1. Without the patch, find any biblio with at least one item attached, and in the items table click Edit item on one of them 2. Without needing to making any changes, click Save changes 3. In the page that loads, scroll down to the bottom of the Add item form, right-click the Add item button, and choose Inspect 4. A few lines up, above a '<fieldset class="action">,' there will be an '<input type="hidden" name="itemnumber" value="633">' with the itemnumber of the item you previously edited 5. Apply patch 6. Scroll up, click Actions - Edit on any item, then Save changes 7. Again, right-click the Add item button, Inspect, note that there isn't a itemnumber input with the number of the item you previously edited Sponsored-by: Chetco Community Public Library Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Pushed for 25.05! Well done everyone, thank you!