Bug 41812 - xt/find-missing-csrf.t failing when JS contains csrf_token hidden input
Summary: xt/find-missing-csrf.t failing when JS contains csrf_token hidden input
Status: Pushed to main
Alias: None
Product: Koha
Classification: Unclassified
Component: Test Suite (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal
Assignee: Jonathan Druart
QA Contact: Nick Clemens (kidclamp)
URL:
Keywords:
Depends on: 41565
Blocks:
  Show dependency treegraph
 
Reported: 2026-02-10 20:14 UTC by Jonathan Druart
Modified: 2026-02-10 22:52 UTC (History)
1 user (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
26.05.00
Circulation function:


Attachments
Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS (1.42 KB, patch)
2026-02-10 20:18 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS (1.47 KB, patch)
2026-02-10 20:27 UTC, Lucas Gass (lukeg)
Details | Diff | Splinter Review
Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS (1.53 KB, patch)
2026-02-10 20:38 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2026-02-10 20:14:30 UTC
commit 7a80a9be011071d504b7ed2aa2190433aed772a5
  Bug 41565: Tidy kohaTable - bookings/list.tt

+                            const csrf_token = $('meta[name="csrf-token"]').attr("content");
                             result += `
                                 <form name="checkout-transform" method="post" action="/cgi-bin/koha/circ/circulation.pl?borrowernumber=%s">
-                                    [% INCLUDE 'csrf-token.inc' %]
+                                    <input type="hidden" name="csrf_token" value="${csrf_token}" />
                                     <input type="hidden" name="op" value="cud-checkout"/>
                                     <input type="hidden" name="borrowernumber" value="%s"/>
                                     <input type="hidden" name="barcode" value="%s"/>

This code injected the csrf token using the TT include file, that made pass xt/find-missing-csrf.t

This bug removed the TT tags from the script tags, and we now need to use a JS variable and retrieve the csrf token from the meta tag.

The test needs to be adjusted.
Comment 1 Jonathan Druart 2026-02-10 20:18:40 UTC
Created attachment 192944 [details] [review]
Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS

This code injected the csrf token using the TT include file, that made
pass xt/find-missing-csrf.t

This bug removed the TT tags from the script tags, and we now need to
use a JS variable and retrieve the csrf token from the meta tag.

This patch suggests to adjust the script to ignore this case. We could
also rewrite the whole JS code and use built the HTML elements using
vanilla JS but that's for another day...
Comment 2 Jonathan Druart 2026-02-10 20:23:47 UTC
The regex is very specific on purpose, to not ignore positives.
Comment 3 Lucas Gass (lukeg) 2026-02-10 20:27:37 UTC
Created attachment 192945 [details] [review]
Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS

This code injected the csrf token using the TT include file, that made
pass xt/find-missing-csrf.t

This bug removed the TT tags from the script tags, and we now need to
use a JS variable and retrieve the csrf token from the meta tag.

This patch suggests to adjust the script to ignore this case. We could
also rewrite the whole JS code and use built the HTML elements using
vanilla JS but that's for another day...

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Comment 4 Nick Clemens (kidclamp) 2026-02-10 20:38:25 UTC
Created attachment 192946 [details] [review]
Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS

This code injected the csrf token using the TT include file, that made
pass xt/find-missing-csrf.t

This bug removed the TT tags from the script tags, and we now need to
use a JS variable and retrieve the csrf token from the meta tag.

This patch suggests to adjust the script to ignore this case. We could
also rewrite the whole JS code and use built the HTML elements using
vanilla JS but that's for another day...

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 5 Lucas Gass (lukeg) 2026-02-10 22:52:34 UTC
Pushed to main for 26.05.00.

Thanks all!