Bugzilla – Dependency tree for
Bug 30524
Add base framework for dealing with CSRF in Koha
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
Max Depth:
Bug 30524
does not depend on any bugs.
Bug 30524
blocks 176 bugs:
view as bug list
30524:
Add base framework for dealing with CSRF in Koha
[CLOSED FIXED; assigned to martin.renvoize]
34426:
Add tests for CSRF checks missing
[Pushed to main; assigned to martin.renvoize]
34478:
Full CSRF protection
[Pushed to main; assigned to jonathan.druart]
34608:
Add sort1 and sort2 to patron search results
[Needs documenting; assigned to oleonard]
38190:
JS error on suggestion page
[RESOLVED FIXED; assigned to jonathan.druart]
38191:
Suggestions filters do not expand
[RESOLVED FIXED; assigned to jonathan.druart]
33484:
Ability to remember user's selected table configuration and search filters for tables
[Needs documenting; assigned to jonathan.druart]
36640:
Upgrade DataTables from 1.13.6 to 2.x
[Pushed to main; assigned to jonathan.druart]
13965:
Add date last seen on item search
[NEW; assigned to gmcharlt]
26553:
Remove KohaTable (columns_settings.inc) and use kohaTable (datatables.js)
[Needs Signoff; assigned to jonathan.druart]
30113:
kohaTable add_filters option should be renamed to show_filter_row
[ASSIGNED; assigned to jake.deery]
33729:
Add a column for dateaccessioned to item search results
[BLOCKED; assigned to Laura.escamilla]
38185:
DT - replace dom with layout
[NEW; assigned to koha-bugs]
38255:
Do not use dataTable constructor directly
[Needs Signoff; assigned to jonathan.druart]
26553:
Remove KohaTable (columns_settings.inc) and use kohaTable (datatables.js)
[Needs Signoff; assigned to jonathan.druart]
(*)
38259:
Adjust DT's lengthMenu option
[NEW; assigned to koha-bugs]
38295:
Standardize "select all" behaviours
[In Discussion; assigned to koha-bugs]
38300:
Cancelling holds in bulk should not need localStorage
[NEW; assigned to koha-bugs]
38296:
Investigate DataTables's extension StateRestore
[ASSIGNED; assigned to jonathan.druart]
38310:
DataTables - Use Select2 for column filters
[ASSIGNED; assigned to jonathan.druart]
38311:
DataTables - Simplify the building of the dropdown list filters
[ASSIGNED; assigned to jonathan.druart]
38388:
Investigate DataTables's extension SearchBuilder
[ASSIGNED; assigned to jonathan.druart]
38436:
Adjust code for column visibility (after DataTables upgrade)
[Pushed to main; assigned to jonathan.druart]
38482:
Disable save state for items tables
[Pushed to main; assigned to jonathan.druart]
38433:
Conflicting behaviour of the columns visibility on the items table
[ASSIGNED; assigned to jonathan.druart]
38485:
Update column visibility on holdings table correctly
[Pushed to main; assigned to jonathan.druart]
38433:
Conflicting behaviour of the columns visibility on the items table
[ASSIGNED; assigned to jonathan.druart]
(*)
38485:
Update column visibility on holdings table correctly
[Pushed to main; assigned to jonathan.druart]
(*)
38595:
Table settings behavior broken on some tables in the OPAC
[Pushed to main; assigned to jonathan.druart]
38440:
dt_button_clear_filter handling outside of datatables.js not needed
[ASSIGNED; assigned to jonathan.druart]
38461:
Table features needs to be covered by e2e tests - Cypress
[Needs Signoff; assigned to jonathan.druart]
38472:
exportColumns hard-coded in patron categories
[NEW; assigned to koha-bugs]
38484:
Filters on the "Holds to pull" page is broken
[Pushed to main; assigned to jonathan.druart]
38543:
dataTables assets included but no longer exist
[Pushed to main; assigned to jonathan.druart]
38596:
DataTable - Previous order sequence behaviour not restored at the OPAC
[Needs Signoff; assigned to jonathan.druart]
38255:
Do not use dataTable constructor directly
[Needs Signoff; assigned to jonathan.druart]
(*)
38114:
columns_settings.inc used when not needed
[RESOLVED DUPLICATE; assigned to jonathan.druart]
38456:
Custom properties no longer accepted by DataTables
[RESOLVED DUPLICATE; assigned to jonathan.druart]
38116:
Patrons search description should be built from DT's search settings
[Needs Signoff; assigned to jonathan.druart]
38242:
ILL table status and backend fitler are not remember when using table's copied sharing link
[NEW; assigned to koha-bugs]
38296:
Investigate DataTables's extension StateRestore
[ASSIGNED; assigned to jonathan.druart]
(*)
38304:
Remove SaveState options for OPAC tables
[Pushed to main; assigned to jonathan.druart]
37238:
Add table settings to itemsearch results
[Needs documenting; assigned to jonathan.druart]
36640:
Upgrade DataTables from 1.13.6 to 2.x
[Pushed to main; assigned to jonathan.druart]
(*)
38331:
Add date accessioned column to itemsearch results
[Signed Off; assigned to lucas]
38433:
Conflicting behaviour of the columns visibility on the items table
[ASSIGNED; assigned to jonathan.druart]
(*)
38482:
Disable save state for items tables
[Pushed to main; assigned to jonathan.druart]
(*)
35992:
opac-shareshelf: Accepting invitation should not be triggered directly
[ASSIGNED; assigned to m.de.rooy]
36192:
[OMNIBUS] CSRF Protection for Koha
[ASSIGNED; assigned to koha-bugs]
37206:
Removing an item from a label batch should be a CSRF-protected POST operation
[Needs documenting; assigned to oleonard]
37235:
Download single authority results in 500 error
[Pushed to stable; assigned to oleonard]
37252:
Saving an authority record as MADS (XML) fails
[Pushed to stable; assigned to phil]
37263:
Creating default article request fees is not working
[Pushed to stable; assigned to pedro.amorim]
37270:
Deleting a report from the actions menu on a list of saved reports does not work
[Needs documenting; assigned to oleonard]
37489:
Cannot delete patron image without uploading a file
[Needs documenting; assigned to samalau]
37580:
Unique holiday descriptions are not editable
[Pushed to stable; assigned to cj.lynce]
37766:
Fix forms that POST without an op in MARC bibliographic frameworks
[Needs documenting; assigned to phil]
37728:
More "op" are missing in POSTed forms
[RESOLVED FIXED; assigned to jonathan.druart]
37794:
Fix form that POSTs without an op in Holds to pull
[Needs documenting; assigned to phil]
37728:
More "op" are missing in POSTed forms
[RESOLVED FIXED; assigned to jonathan.druart]
(*)
37827:
Switch OPAC download list form from POST to GET
[Needs documenting; assigned to phil]
37728:
More "op" are missing in POSTed forms
[RESOLVED FIXED; assigned to jonathan.druart]
(*)
37853:
Returning to your account at the end of changing your password in the OPAC doesn't need to POST a form
[Needs documenting; assigned to phil]
37728:
More "op" are missing in POSTed forms
[RESOLVED FIXED; assigned to jonathan.druart]
(*)
37887:
OPAC password recovery needs to use a cud- op while POSTing new password
[Pushed to stable; assigned to phil]
37728:
More "op" are missing in POSTed forms
[RESOLVED FIXED; assigned to jonathan.druart]
(*)
37914:
Forms for budget planning filters and export should GET rather than POST
[Pushed to stable; assigned to phil]
37728:
More "op" are missing in POSTed forms
[RESOLVED FIXED; assigned to jonathan.druart]
(*)
37916:
Plugin search and install regression
[Needs documenting; assigned to martin.renvoize]
37993:
Having a single EDI EAN account produces a bad redirect
[Pushed to main; assigned to martin.renvoize]
38275:
Unable to delete patron card creator images
[Pushed to stable; assigned to dcook]
38309:
Cannot delete additional fields
[Pushed to main; assigned to phil]
38328:
Cannot delete ILL batch statuses
[Pushed to main; assigned to phil]
38378:
Serial frequency deletion is broken
[Pushed to main; assigned to phil]
38463:
Unnecessary CSRF token in OPAC authority search
[Pushed to main; assigned to phil]
36597:
Cannot delete circulation desk
[RESOLVED FIXED; assigned to oleonard]
36598:
Add CSRF protection to Mojolicious apps
[RESOLVED FIXED; assigned to julian.maurice]
37069:
Authorities pagination on OPAC broken by CSRF
[RESOLVED FIXED; assigned to nick]
38463:
Unnecessary CSRF token in OPAC authority search
[Pushed to main; assigned to phil]
(*)
37080:
Cannot delete a MARC bibliographic framework or authority type
[RESOLVED FIXED; assigned to phil]
37093:
403 Forbidden Error when attempting to search for Mana Reports
[RESOLVED FIXED; assigned to phil]
37187:
Label batches and label templates cannot be deleted
[RESOLVED FIXED; assigned to oleonard]
37192:
Can't print label from the item editor
[RESOLVED FIXED; assigned to lucas]
37197:
Batch patron modification from reports fails by using GET instead of POST
[RESOLVED FIXED; assigned to phil]
37188:
Batch patron modification from report results should be an option when borrowernumber is selected
[Needs documenting; assigned to nick]
37481:
Some operations that do not affect data should be submitted as POST requests
[NEW; assigned to koha-bugs]
37615:
Clean up the form for sending cardnumbers from a report to batch patron modification
[RESOLVED FIXED; assigned to phil]
37409:
Edit button for items in course reserves list doesn't work
[RESOLVED FIXED; assigned to samalau]
37728:
More "op" are missing in POSTed forms
[RESOLVED FIXED; assigned to jonathan.druart]
(*)
37741:
Koha errors on page (e.g. 404) cause incorrect CSRF errors
[RESOLVED FIXED; assigned to dcook]
37765:
Fix forms that POST without an op in systempreferences
[RESOLVED FIXED; assigned to phil]
37728:
More "op" are missing in POSTed forms
[RESOLVED FIXED; assigned to jonathan.druart]
(*)
37767:
Fix forms that POST without an op in Authority types
[RESOLVED FIXED; assigned to phil]
37728:
More "op" are missing in POSTed forms
[RESOLVED FIXED; assigned to jonathan.druart]
(*)
37768:
Fix form that POSTs without an op in itemtype administration
[RESOLVED FIXED; assigned to phil]
37728:
More "op" are missing in POSTed forms
[RESOLVED FIXED; assigned to jonathan.druart]
(*)
37769:
Fix forms that POST without an op in currency administration
[RESOLVED FIXED; assigned to phil]
37728:
More "op" are missing in POSTed forms
[RESOLVED FIXED; assigned to jonathan.druart]
(*)
37779:
Fix forms that POST without an op in tag moderation
[RESOLVED FIXED; assigned to phil]
37728:
More "op" are missing in POSTed forms
[RESOLVED FIXED; assigned to jonathan.druart]
(*)
37783:
Fix form that looks like it would POST without an op in reserve/request.tt
[RESOLVED FIXED; assigned to phil]
37817:
Cancellation holds alert not displayed the correct number of holds
[NEW; assigned to koha-bugs]
37728:
More "op" are missing in POSTed forms
[RESOLVED FIXED; assigned to jonathan.druart]
(*)
37785:
Remove dead code in tools/letter.tt that looks like a form that would POST without an op
[RESOLVED FIXED; assigned to phil]
37728:
More "op" are missing in POSTed forms
[RESOLVED FIXED; assigned to jonathan.druart]
(*)
37959:
Item circulation alerts table appears to be broken
[RESOLVED FIXED; assigned to phil]
37961:
Inventory followup fails by POSTing without an op or csrf_token
[RESOLVED FIXED; assigned to phil]
36189:
Rewrite www/auth_values_input_www.t using Selenium
[NEW; assigned to chris]
36192:
[OMNIBUS] CSRF Protection for Koha
[ASSIGNED; assigned to koha-bugs]
(*)
36192:
[OMNIBUS] CSRF Protection for Koha
[ASSIGNED; assigned to koha-bugs]
(*)
36195:
CSRF - testing reports
[NEW; assigned to koha-bugs]
36192:
[OMNIBUS] CSRF Protection for Koha
[ASSIGNED; assigned to koha-bugs]
(*)
36349:
Login for SCO/SCI broken by CSRF
[RESOLVED FIXED; assigned to jonathan.druart]
32256:
Self checkout batch mode
[RESOLVED FIXED; assigned to aleisha]
36718:
Include item barcode in checkout error message on self-check
[NEW; assigned to koha-bugs]
37525:
Self checkout: "Return this item" doesn't show up in scan confirmation screen despite SCOAllowCheckin being allowed
[Pushed to stable; assigned to oliver.behnke]
38174:
Self Checkout renders alert for each checkout in session instead of just most recent checkout
[Needs Signoff; assigned to blawlor]
36207:
Update browser alerts to modals: OPAC tags
[Needs documenting; assigned to oleonard]
36166:
Disable select to add to list if opacuserlogin is disabled
[Needs documenting; assigned to matthias.le-gac]
36557:
Improve logic and display of OPAC cart, tag, and lists controls
[Needs documenting; assigned to oleonard]
38620:
Non-existent hc-sticky asset included in opac-tags
[Needs Signoff; assigned to oleonard]
36557:
Improve logic and display of OPAC cart, tag, and lists controls
[Needs documenting; assigned to oleonard]
(*)
36863:
CSRF Plack middleware doesn't handle the CONNECT HTTP method
[Needs documenting; assigned to koha-bugs]
37150:
Can't delete single title from a list using the "Remove from list" link
[Needs documenting; assigned to oleonard]
36557:
Improve logic and display of OPAC cart, tag, and lists controls
[Needs documenting; assigned to oleonard]
(*)
38251:
"Remove selected items" button not removing single item in OPAC lists
[Pushed to stable; assigned to phil]
37264:
Fix delete button on staff interface's suggestion detail page
[Pushed to stable; assigned to oleonard]
37290:
Deleting circulation rule for a specific library deletes for All libraries instead
[Needs documenting; assigned to januszop]
37263:
Creating default article request fees is not working
[Pushed to stable; assigned to pedro.amorim]
(*)
37483:
Batch extend due dates tool not working
[Needs documenting; assigned to nick]
36192:
[OMNIBUS] CSRF Protection for Koha
[ASSIGNED; assigned to koha-bugs]
(*)
37941:
Batch extend due date tool should separate actions/forms
[NEW; assigned to koha-bugs]
38199:
Printing transfer slips from circ/returns.pl doesn't set focus properly ( 24.05.x and below )
[Needs documenting; assigned to lucas]
38495:
Cannot cancel background job (CSRF)
[Pushed to main; assigned to nick]
36102:
Protect login forms from CSRF attacks
[RESOLVED FIXED; assigned to jonathan.druart]
36192:
[OMNIBUS] CSRF Protection for Koha
[ASSIGNED; assigned to koha-bugs]
(*)
36084:
Pass CSRF token to SVC scripts (1/2)
[RESOLVED FIXED; assigned to jonathan.druart]
36211:
Add support for script modules to Asset
[NEW; assigned to oleonard]
37332:
Renewal due date and renew as unseen fields not respected when renewing an item from the patron account
[Needs documenting; assigned to emily.lamancusa]
36192:
[OMNIBUS] CSRF Protection for Koha
[ASSIGNED; assigned to koha-bugs]
(*)
37189:
Renewals: Koha prioritizes hard due date from circulation rules over manual due date, although the manual due date is earlier
[RESOLVED WORKSFORME; assigned to koha-bugs]
36234:
Language prefs cannot be modified
[RESOLVED FIXED; assigned to jonathan.druart]
36235:
System preferences chopping everything after a semicolon.
[RESOLVED FIXED; assigned to lucas]
36407:
Custom renewal date is not respected when renewing items from the checkouts table
[RESOLVED DUPLICATE; assigned to koha-bugs]
36192:
[OMNIBUS] CSRF Protection for Koha
[ASSIGNED; assigned to koha-bugs]
(*)
36426:
Cannot set article request as pending
[RESOLVED FIXED; assigned to jonathan.druart]
36308:
SIP2 login broken by CSRF changes
[RESOLVED FIXED; assigned to nick]
36349:
Login for SCO/SCI broken by CSRF
[RESOLVED FIXED; assigned to jonathan.druart]
(*)
36148:
Move CSRF check code outside of CGI->new
[RESOLVED FIXED; assigned to jonathan.druart]
36192:
[OMNIBUS] CSRF Protection for Koha
[ASSIGNED; assigned to koha-bugs]
(*)
36177:
We need integration tests to cover CSRF checks
[RESOLVED FIXED; assigned to jonathan.druart]
36355:
Auth/csrf.ts is failing if library with long info in the DB
[RESOLVED FIXED; assigned to jonathan.druart]
36358:
Typo in errorpage.tt: requets
[RESOLVED FIXED; assigned to tomascohen]
36190:
op param for stateful requests must start with 'cud-'
[RESOLVED FIXED; assigned to nick]
36192:
[OMNIBUS] CSRF Protection for Koha
[ASSIGNED; assigned to koha-bugs]
(*)
36193:
CSRF - Code review missed
[RESOLVED FIXED; assigned to koha-bugs]
36192:
[OMNIBUS] CSRF Protection for Koha
[ASSIGNED; assigned to koha-bugs]
(*)
36219:
State parameter broken for OIDC/Oauth
[RESOLVED FIXED; assigned to dcook]
36192:
[OMNIBUS] CSRF Protection for Koha
[ASSIGNED; assigned to koha-bugs]
(*)
36237:
Improve set-library UI after 34478
[RESOLVED INVALID; assigned to lucas]
36241:
ILL Batches are broken
[RESOLVED FIXED; assigned to pedro.amorim]
36273:
ILL - Refactor $op in ill-requests.pl
[NEW; assigned to koha-bugs]
36130:
ILL batches table not showing all batches
[RESOLVED FIXED; assigned to pedro.amorim]
36291:
Scrolling glitch on datatables with fixed header
[Failed QA; assigned to baptiste.wojtkowski]
36249:
ILL - "Request from partners" action is broken
[RESOLVED FIXED; assigned to pedro.amorim]
36273:
ILL - Refactor $op in ill-requests.pl
[NEW; assigned to koha-bugs]
(*)
36245:
ILL - Custom backend form action is broken
[RESOLVED FIXED; assigned to pedro.amorim]
36273:
ILL - Refactor $op in ill-requests.pl
[NEW; assigned to koha-bugs]
(*)
35581:
ILL Koha classes are not consistent
[RESOLVED FIXED; assigned to pedro.amorim]
35570:
Add a generic master form in ILL
[Pushed to main; assigned to pedro.amorim]
35725:
Generic master form does not keep patron and cardnumber when changing type
[Pushed to main; assigned to pedro.amorim]
36221:
Improve styling of Standard backend create OPAC form
[Needs documenting; assigned to pedro.amorim]
35604:
ILL - Allow for automatic backend selection
[Signed Off; assigned to pedro.amorim]
36197:
Allow for OPAC unauthenticated ILL request
[Signed Off; assigned to pedro.amorim]
38441:
ILL - Allow for a history check workflow stage
[Needs Signoff; assigned to pedro.amorim]
38523:
Simple quote in ILL standard form JS can break translations
[NEW; assigned to koha-bugs]
38276:
ILL Standard form does not consider DOI in openURL
[Pushed to main; assigned to pedro.amorim]
38288:
Provide openURL backwards compatibility with FreeForm
[Pushed to main; assigned to pedro.amorim]
38289:
ILL module should create biblios for DVD and Thesis documents
[NEW; assigned to koha-bugs]
38339:
Standard backend _get_core_fields are not translatable
[NEW; assigned to koha-bugs]
38340:
Translatability - Standard form include files are not translatable
[NEW; assigned to koha-bugs]
38523:
Simple quote in ILL standard form JS can break translations
[NEW; assigned to koha-bugs]
(*)
38341:
Standard backend is missing unit tests
[NEW; assigned to koha-bugs]
36662:
ILL - t/db_dependent/Illrequest should not exist
[Signed Off; assigned to pedro.amorim]
35604:
ILL - Allow for automatic backend selection
[Signed Off; assigned to pedro.amorim]
(*)
36243:
ILL "Edit request" action is broken
[RESOLVED FIXED; assigned to pedro.amorim]
36273:
ILL - Refactor $op in ill-requests.pl
[NEW; assigned to koha-bugs]
(*)
36249:
ILL - "Request from partners" action is broken
[RESOLVED FIXED; assigned to pedro.amorim]
(*)
36274:
OPAC suggestions form doesn't display
[RESOLVED FIXED; assigned to lucas]
36044:
Show ISBN number of purchase suggestions on the OPAC
[BLOCKED; assigned to oleonard]
36280:
Viewing batch of staged records broken: CSRF token error
[RESOLVED DUPLICATE; assigned to koha-bugs]
36326:
Batch deletion of selected items from detail page is broken
[RESOLVED FIXED; assigned to jonathan.druart]
36192:
[OMNIBUS] CSRF Protection for Koha
[ASSIGNED; assigned to koha-bugs]
(*)
36336:
Exporting records from detail page is broken
[RESOLVED FIXED; assigned to jonathan.druart]
36349:
Login for SCO/SCI broken by CSRF
[RESOLVED FIXED; assigned to jonathan.druart]
(*)
36351:
CSRF Adjustments for Cataloguing editor
[RESOLVED FIXED; assigned to nick]
36377:
Fix translatability issues in koha-backend.js
[NEW; assigned to koha-bugs]
38082:
Advanced editor does not save the selected framework with new record
[Pushed to stable; assigned to januszop]
36418:
Set response's content-type to application/json when needed - svc scripts
[RESOLVED FIXED; assigned to lucas]
36060:
If issues table includes overdues 'Renew selected items' button is disabled
[RESOLVED FIXED; assigned to lucas]
36368:
Cannot save new patron after error
[RESOLVED FIXED; assigned to emmi.takkinen]
36384:
'Used saved' typo in guided reports
[RESOLVED FIXED; assigned to tomascohen]
36568:
Changing rows per page on a custom report is broken
[RESOLVED FIXED; assigned to emily.lamancusa]
36577:
(bug 34478 follow-up) marc21_linking_section.pl not working
[RESOLVED FIXED; assigned to januszop]
36630:
Item search batch operations buttons broken by CSRF
[RESOLVED FIXED; assigned to blawlor]
36192:
[OMNIBUS] CSRF Protection for Koha
[ASSIGNED; assigned to koha-bugs]
(*)
38413:
Batch operations from item search results fail when "select visible rows" and many items are selected
[Pushed to stable; assigned to phil]
36838:
Can't approve or reject tags in the staff interface
[RESOLVED FIXED; assigned to oleonard]
36877:
Patron card creator does not work when editing layout, profile or template
[RESOLVED FIXED; assigned to bibliothek]
36192:
[OMNIBUS] CSRF Protection for Koha
[ASSIGNED; assigned to koha-bugs]
(*)
36883:
Can't finish club enrollment in the OPAC
[RESOLVED FIXED; assigned to jonathan.druart]
36995:
Can't delete library EAN
[RESOLVED FIXED; assigned to oleonard]
37039:
Cannot request a discharge in the OPAC
[RESOLVED FIXED; assigned to oleonard]
37111:
OPAC renewal - CSRF "op must be set"
[RESOLVED FIXED; assigned to lucas]
36192:
[OMNIBUS] CSRF Protection for Koha
[ASSIGNED; assigned to koha-bugs]
(*)
37786:
members/cancel-charge.pl needs CSRF protection
[RESOLVED FIXED; assigned to phil]
37728:
More "op" are missing in POSTed forms
[RESOLVED FIXED; assigned to jonathan.druart]
(*)
38056:
Search term after deleting an authority shouldn't be URI encoded
[RESOLVED FIXED; assigned to phil]
34478:
Full CSRF protection
[Pushed to main; assigned to jonathan.druart]
(*)
22990:
Add CSRF protection to boraccount, pay, suggestions and virtualshelves on staff
[RESOLVED FIXED; assigned to martin.renvoize]
34601:
Cannot manage suggestions without CSRF error
[RESOLVED FIXED; assigned to lucas]
34650:
Editing/deleting lists from toolbar on virtualshelves/shelves.pl causes CSRF error
[RESOLVED FIXED; assigned to dcook]
34368:
Add CSRF protection to Content Management pages
[RESOLVED FIXED; assigned to dcook]
35752:
Can't delete additional contents with 'Delete selected' button
[Pushed to stable; assigned to lucas]
35753:
Checkbox() function in additional-contents not necessary
[Pushed to stable; assigned to lucas]
35019:
Can't delete news from the staff interface main page
[CLOSED FIXED; assigned to emily-rose.francoeur]
34369:
Add CSRF protection to system preferences
[RESOLVED FIXED; assigned to dcook]
Max Depth: