commit 7a80a9be011071d504b7ed2aa2190433aed772a5 Bug 41565: Tidy kohaTable - bookings/list.tt + const csrf_token = $('meta[name="csrf-token"]').attr("content"); result += ` <form name="checkout-transform" method="post" action="/cgi-bin/koha/circ/circulation.pl?borrowernumber=%s"> - [% INCLUDE 'csrf-token.inc' %] + <input type="hidden" name="csrf_token" value="${csrf_token}" /> <input type="hidden" name="op" value="cud-checkout"/> <input type="hidden" name="borrowernumber" value="%s"/> <input type="hidden" name="barcode" value="%s"/> This code injected the csrf token using the TT include file, that made pass xt/find-missing-csrf.t This bug removed the TT tags from the script tags, and we now need to use a JS variable and retrieve the csrf token from the meta tag. The test needs to be adjusted.
Created attachment 192944 [details] [review] Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS This code injected the csrf token using the TT include file, that made pass xt/find-missing-csrf.t This bug removed the TT tags from the script tags, and we now need to use a JS variable and retrieve the csrf token from the meta tag. This patch suggests to adjust the script to ignore this case. We could also rewrite the whole JS code and use built the HTML elements using vanilla JS but that's for another day...
The regex is very specific on purpose, to not ignore positives.
Created attachment 192945 [details] [review] Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS This code injected the csrf token using the TT include file, that made pass xt/find-missing-csrf.t This bug removed the TT tags from the script tags, and we now need to use a JS variable and retrieve the csrf token from the meta tag. This patch suggests to adjust the script to ignore this case. We could also rewrite the whole JS code and use built the HTML elements using vanilla JS but that's for another day... Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Created attachment 192946 [details] [review] Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS This code injected the csrf token using the TT include file, that made pass xt/find-missing-csrf.t This bug removed the TT tags from the script tags, and we now need to use a JS variable and retrieve the csrf token from the meta tag. This patch suggests to adjust the script to ignore this case. We could also rewrite the whole JS code and use built the HTML elements using vanilla JS but that's for another day... Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Pushed to main for 26.05.00. Thanks all!