Bug 41039 - Patron search button can be spammed and trigger many API patron searches
Summary: Patron search button can be spammed and trigger many API patron searches
Status: Pushed to stable
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal
Assignee: Kyle M Hall (khall)
QA Contact: Testopia
URL:
Keywords: release-notes-needed
Depends on:
Blocks: 41048
  Show dependency treegraph
 
Reported: 2025-10-16 23:09 UTC by Kyle M Hall (khall)
Modified: 2025-11-25 16:31 UTC (History)
8 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
25.11.00,25.05.06
Circulation function:


Attachments
Bug 41039: Prevent patron search button from being spammed triggering multiple api requests (3.90 KB, patch)
2025-10-17 11:20 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 41039: Prevent patron search button from being spammed triggering multiple api requests (3.96 KB, patch)
2025-10-17 19:15 UTC, Caroline Cyr La Rose
Details | Diff | Splinter Review
Bug 41039: Prevent patron search button from being spammed triggering multiple api requests (4.01 KB, patch)
2025-10-21 05:33 UTC, David Cook
Details | Diff | Splinter Review
Bug 41039: Prevent patron search button from being spammed triggering multiple api requests (4.03 KB, patch)
2025-11-04 15:42 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 41039: Add cypress tests (1.56 KB, patch)
2025-11-04 15:42 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 41039: Prevent patron search button from being spammed triggering multiple api requests (4.06 KB, patch)
2025-11-18 01:21 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 41039: Add cypress tests (1.59 KB, patch)
2025-11-18 01:21 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Kyle M Hall (khall) 2025-10-16 23:09:22 UTC
Every click of the "Search" button on members/members-home.pl will trigger another patron search api request. This button should be disabled until the first searches results are displayed.

To demonstrate, open the network tab of the developer console on your web browser. Note each click if the button show another patron search api request.
Comment 1 Kyle M Hall (khall) 2025-10-17 11:20:49 UTC
Created attachment 188063 [details] [review]
Bug 41039: Prevent patron search button from being spammed triggering multiple api requests

Every click of the "Search" button on members/members-home.pl or other area that utilizes patrons searching,
will trigger another patron search api request. This button should be disabled until the first searches results are displayed.

To demonstrate, open the network tab of the developer console on your web browser. Note each click if the button show another patron search api request.

Test Plan:
1) Browse to members-home.pl
2) Open the network tab of the developer console on your web browser
3) Double click the Search button
4) Note the two api requests in the network tab
5) Apply this patch
6) Reload the page
7) Double click the Search button
8) Note only one api request is made

If your results come back too fast, you may perform an initial search,
then change the number of results from the default 20 to "All" to
create a search that will take longer.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 2 Caroline Cyr La Rose 2025-10-17 19:15:16 UTC
Created attachment 188123 [details] [review]
Bug 41039: Prevent patron search button from being spammed triggering multiple api requests

Every click of the "Search" button on members/members-home.pl or other area that utilizes patrons searching,
will trigger another patron search api request. This button should be disabled until the first searches results are displayed.

To demonstrate, open the network tab of the developer console on your web browser. Note each click if the button show another patron search api request.

Test Plan:
1) Browse to members-home.pl
2) Open the network tab of the developer console on your web browser
3) Double click the Search button
4) Note the two api requests in the network tab
5) Apply this patch
6) Reload the page
7) Double click the Search button
8) Note only one api request is made

If your results come back too fast, you may perform an initial search,
then change the number of results from the default 20 to "All" to
create a search that will take longer.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Comment 3 Caroline Cyr La Rose 2025-10-17 19:15:51 UTC
I needed to put it in "Need Signoff" to then go to "Signed off". Sorry!
Comment 4 Jonathan Druart 2025-10-20 07:33:07 UTC
Shouldn't we use preventDoubleFormSubmit here?
Comment 5 Kyle M Hall (khall) 2025-10-20 11:16:52 UTC
(In reply to Jonathan Druart from comment #4)
> Shouldn't we use preventDoubleFormSubmit here?

I don't think that code works here because this is an ajax based search, so the doesn't reload after results are returned.
Comment 6 Jonathan Druart 2025-10-20 12:07:57 UTC
(In reply to Kyle M Hall (khall) from comment #5)
> (In reply to Jonathan Druart from comment #4)
> > Shouldn't we use preventDoubleFormSubmit here?
> 
> I don't think that code works here because this is an ajax based search, so
> the doesn't reload after results are returned.

Indeed sorry, silly idea.
Comment 7 David Cook 2025-10-21 05:32:28 UTC
Test plan doesn't include tests for other places like http://localhost:8081/cgi-bin/koha/reserve/request.pl?biblionumber=29 but it does appear to work there too
Comment 8 David Cook 2025-10-21 05:33:19 UTC
Created attachment 188191 [details] [review]
Bug 41039: Prevent patron search button from being spammed triggering multiple api requests

Every click of the "Search" button on members/members-home.pl or other area that utilizes patrons searching,
will trigger another patron search api request. This button should be disabled until the first searches results are displayed.

To demonstrate, open the network tab of the developer console on your web browser. Note each click if the button show another patron search api request.

Test Plan:
1) Browse to members-home.pl
2) Open the network tab of the developer console on your web browser
3) Double click the Search button
4) Note the two api requests in the network tab
5) Apply this patch
6) Reload the page
7) Double click the Search button
8) Note only one api request is made

If your results come back too fast, you may perform an initial search,
then change the number of results from the default 20 to "All" to
create a search that will take longer.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 9 Jonathan Druart 2025-10-21 06:48:01 UTC
We need Cypress or Selenium tests here.
Comment 10 David Cook 2025-10-23 00:27:42 UTC
(In reply to Jonathan Druart from comment #9)
> We need Cypress or Selenium tests here.

Yeah, that thought crossed my mind. You're right. I wonder how best do that in this case. Wondering if we need to mock an endpoint to produce a delayed response so we can detect the disabled button?
Comment 11 Jonathan Druart 2025-10-23 07:25:31 UTC
(In reply to David Cook from comment #10)
> (In reply to Jonathan Druart from comment #9)
> > We need Cypress or Selenium tests here.
> 
> Yeah, that thought crossed my mind. You're right. I wonder how best do that
> in this case. Wondering if we need to mock an endpoint to produce a delayed
> response so we can detect the disabled button?

I would try the easy way:
Click "search", wait for the button to be disabled, then wait for the button to be enabled, then eventually click "search" again.
Cypress is fast and the button should be disabled before we get the response.

Run it in a loop to make sure it won't fail randomly.
Comment 12 Kyle M Hall (khall) 2025-11-04 15:42:21 UTC
Created attachment 189031 [details] [review]
Bug 41039: Prevent patron search button from being spammed triggering multiple api requests

Every click of the "Search" button on members/members-home.pl or other area that utilizes patrons searching,
will trigger another patron search api request. This button should be disabled until the first searches results are displayed.
To demonstrate, open the network tab of the developer console on your web browser. Note each click if the button show another patron search api request.
Test Plan:
1) Browse to members-home.pl
2) Open the network tab of the developer console on your web browser
3) Double click the Search button
4) Note the two api requests in the network tab
5) Apply this patch
6) Reload the page
7) Double click the Search button
8) Note only one api request is made
If your results come back too fast, you may perform an initial search,
then change the number of results from the default 20 to "All" to
create a search that will take longer.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 13 Kyle M Hall (khall) 2025-11-04 15:42:22 UTC
Created attachment 189032 [details] [review]
Bug 41039: Add cypress tests

Patch from commit 2fcd87f
Comment 14 Kyle M Hall (khall) 2025-11-04 15:42:24 UTC
Every click of the "Search" button on members/members-home.pl or other area that utilizes patrons searching,
will trigger another patron search api request. This button should be disabled until the first searches results are displayed.
To demonstrate, open the network tab of the developer console on your web browser. Note each click if the button show another patron search api request.
Test Plan:
1) Browse to members-home.pl
2) Open the network tab of the developer console on your web browser
3) Double click the Search button
4) Note the two api requests in the network tab
5) Apply this patch
6) Reload the page
7) Double click the Search button
8) Note only one api request is made
If your results come back too fast, you may perform an initial search,
then change the number of results from the default 20 to "All" to
create a search that will take longer.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 15 Nick Clemens (kidclamp) 2025-11-18 01:21:46 UTC
Created attachment 189649 [details] [review]
Bug 41039: Prevent patron search button from being spammed triggering multiple api requests

Every click of the "Search" button on members/members-home.pl or other area that utilizes patrons searching,
will trigger another patron search api request. This button should be disabled until the first searches results are displayed.

To demonstrate, open the network tab of the developer console on your web browser. Note each click if the button show another patron search api request.

Test Plan:
1) Browse to members-home.pl
2) Open the network tab of the developer console on your web browser
3) Double click the Search button
4) Note the two api requests in the network tab
5) Apply this patch
6) Reload the page
7) Double click the Search button
8) Note only one api request is made

If your results come back too fast, you may perform an initial search,
then change the number of results from the default 20 to "All" to
create a search that will take longer.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 16 Nick Clemens (kidclamp) 2025-11-18 01:21:51 UTC
Created attachment 189650 [details] [review]
Bug 41039: Add cypress tests

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 17 Lucas Gass (lukeg) 2025-11-18 14:00:34 UTC
Nice work everyone!

Pushed to main for 25.11
Comment 18 Paul Derscheid 2025-11-25 16:31:07 UTC
Nice work everyone!

Pushed to 25.05.x