Max Depth:

Bug 36148 depends on 24 bugs:

view as bug list

•    36148: Move CSRF check code outside of CGI->new [CLOSED FIXED; assigned to jonathan.druart]
  •    34478: Full CSRF protection [Pushed to main; assigned to jonathan.druart]
    •    35890: AutoLocation system preference + setting the library IP field - can still login and unexpected results [Pushed to oldoldoldstable; assigned to jonathan.druart]
      •    35904: C4::Auth::checkauth cannot be tested easily [Pushed to oldstable; assigned to jonathan.druart]
    •    35955: New CSRF token generated everytime we need one [Pushed to oldstable; assigned to dcook]
    •    36092: sessionID not passed to the template on auth.tt [Pushed to oldstable; assigned to jonathan.druart]
      •    35890: AutoLocation system preference + setting the library IP field - can still login and unexpected results [Pushed to oldoldoldstable; assigned to jonathan.druart] (*)
    •    36098: Create Koha::Session module [Needs documenting; assigned to dcook]
    •    30524: Add base framework for dealing with CSRF in Koha [CLOSED FIXED; assigned to martin.renvoize]
    •    34426: Add tests for CSRF checks missing [CLOSED FIXED; assigned to martin.renvoize]
      •    30524: Add base framework for dealing with CSRF in Koha [CLOSED FIXED; assigned to martin.renvoize] (*)
    •    35935: Wrong branch picked after an incorrect login [RESOLVED FIXED; assigned to jonathan.druart]
    •    35951: We don't need category-out-of-age-limit.inc [RESOLVED FIXED; assigned to tomascohen]
    •    36017: Dead code in admin/clone-rules [CLOSED FIXED; assigned to jonathan.druart]
      •    18936: Move issuingrules into circulation_rules [CLOSED FIXED; assigned to jonathan.druart]
        •    18930: Move 'refund lost item fee rules' into the `circulation_rules` table [CLOSED FIXED; assigned to jonathan.druart]
          •    18928: Move `holdallowed`, `hold_fulfillment_policy` and `returnbranch` into the `circulation_rules` table. [CLOSED FIXED; assigned to jonathan.druart]
            •    18925: Move maxissueqty and maxonsiteissueqty to circulation_rules [CLOSED FIXED; assigned to jonathan.druart]
              •    18887: Introduce new table 'circulation_rules', use for 'max_holds' rules [CLOSED FIXED; assigned to jonathan.druart]
                •    15524: Set limit on maximum possible holds per patron by category [CLOSED FIXED; assigned to kyle]
                  •    20227: admin/smart-rules.pl should pass categorycode instead of branchcode [CLOSED FIXED; assigned to m.de.rooy]
                    •    2000: separation of issuing & fines rules breaks defaults propagation [CLOSED FIXED; assigned to gmcharlt]
            •    22847: Specific circ rule by patron category is displaying the default (or not displaying) [CLOSED FIXED; assigned to jonathan.druart]
              •    18887: Introduce new table 'circulation_rules', use for 'max_holds' rules [CLOSED FIXED; assigned to jonathan.druart] (*)
              •    18925: Move maxissueqty and maxonsiteissueqty to circulation_rules [CLOSED FIXED; assigned to jonathan.druart] (*)
    •    36019: Dead code in tags/review [CLOSED FIXED; assigned to jonathan.druart]
      •    20489: Prevent DB user login [CLOSED FIXED; assigned to jonathan.druart]
        •    20580: create_superlibrarian.pl should accept parameters [CLOSED FIXED; assigned to jonathan.druart]
    •    37040: ErrorDocument accidentally setting off CSRF [RESOLVED FIXED; assigned to dcook]

Bug 36148 blocks 49 bugs:

view as bug list

•    36148: Move CSRF check code outside of CGI->new [CLOSED FIXED; assigned to jonathan.druart]
  •    36192: [OMNIBUS] CSRF Protection for Koha [ASSIGNED; assigned to koha-bugs]
    •    37206: Removing an item from a label batch should be a CSRF-protected POST operation [Needs documenting; assigned to oleonard]
    •    37235: Download single authority results in 500 error [Needs documenting; assigned to oleonard]
      •    37252: Saving an authority record as MADS (XML) fails [RESOLVED FIXED; assigned to phil]
    •    37270: Deleting a report from the actions menu on a list of saved reports does not work [Needs documenting; assigned to oleonard]
    •    37489: Cannot delete patron image without uploading a file [Needs documenting; assigned to samalau]
    •    37580: Unique holiday descriptions are not editable [Needs documenting; assigned to cj.lynce]
    •    37766: Fix forms that POST without an op in MARC bibliographic frameworks [Needs documenting; assigned to phil]
      •    37728: More "op" are missing in POSTed forms [RESOLVED FIXED; assigned to jonathan.druart]
    •    37794: Fix form that POSTs without an op in Holds to pull [Needs documenting; assigned to phil]
      •    37728: More "op" are missing in POSTed forms [RESOLVED FIXED; assigned to jonathan.druart] (*)
    •    37914: Forms for budget planning filters and export should GET rather than POST [Needs documenting; assigned to phil]
      •    37728: More "op" are missing in POSTed forms [RESOLVED FIXED; assigned to jonathan.druart] (*)
    •    37916: Plugin search and install regression [Needs documenting; assigned to martin.renvoize]
    •    37993: Having a single EDI EAN account produces a bad redirect [Pushed to main; assigned to martin.renvoize]
    •    38275: Unable to delete patron card creator images [Needs documenting; assigned to dcook]
    •    38382: Need a fresh connection when CSRF has expired for connexion daemon [Pushed to main; assigned to nick]
    •    36597: Cannot delete circulation desk [CLOSED FIXED; assigned to oleonard]
    •    36598: Add CSRF protection to Mojolicious apps [RESOLVED FIXED; assigned to julian.maurice]
    •    37069: Authorities pagination on OPAC broken by CSRF [RESOLVED FIXED; assigned to nick]
      •    38463: Unnecessary CSRF token in OPAC authority search [RESOLVED FIXED; assigned to phil]
    •    37080: Cannot delete a MARC bibliographic framework or authority type [RESOLVED FIXED; assigned to phil]
    •    37093: 403 Forbidden Error when attempting to search for Mana Reports [RESOLVED FIXED; assigned to phil]
    •    37187: Label batches and label templates cannot be deleted [RESOLVED FIXED; assigned to oleonard]
    •    37192: Can't print label from the item editor [RESOLVED FIXED; assigned to lucas]
    •    37197: Batch patron modification from reports fails by using GET instead of POST [RESOLVED FIXED; assigned to phil]
      •    37188: Batch patron modification from report results should be an option when borrowernumber is selected [Needs documenting; assigned to nick]
      •    37481: Some operations that do not affect data should be submitted as POST requests [NEW; assigned to koha-bugs]
      •    37615: Clean up the form for sending cardnumbers from a report to batch patron modification [RESOLVED FIXED; assigned to phil]
    •    37263: Creating default article request fees is not working [RESOLVED FIXED; assigned to pedro.amorim]
    •    37409: Edit button for items in course reserves list doesn't work [RESOLVED FIXED; assigned to samalau]
    •    37728: More "op" are missing in POSTed forms [RESOLVED FIXED; assigned to jonathan.druart] (*)
    •    37741: Koha errors on page (e.g. 404) cause incorrect CSRF errors [RESOLVED FIXED; assigned to dcook]
    •    37765: Fix forms that POST without an op in systempreferences [RESOLVED FIXED; assigned to phil]
      •    37728: More "op" are missing in POSTed forms [RESOLVED FIXED; assigned to jonathan.druart] (*)
    •    37767: Fix forms that POST without an op in Authority types [RESOLVED FIXED; assigned to phil]
      •    37728: More "op" are missing in POSTed forms [RESOLVED FIXED; assigned to jonathan.druart] (*)
    •    37768: Fix form that POSTs without an op in itemtype administration [RESOLVED FIXED; assigned to phil]
      •    37728: More "op" are missing in POSTed forms [RESOLVED FIXED; assigned to jonathan.druart] (*)
    •    37769: Fix forms that POST without an op in currency administration [RESOLVED FIXED; assigned to phil]
      •    37728: More "op" are missing in POSTed forms [RESOLVED FIXED; assigned to jonathan.druart] (*)
    •    37779: Fix forms that POST without an op in tag moderation [RESOLVED FIXED; assigned to phil]
      •    37728: More "op" are missing in POSTed forms [RESOLVED FIXED; assigned to jonathan.druart] (*)
    •    37783: Fix form that looks like it would POST without an op in reserve/request.tt [RESOLVED FIXED; assigned to phil]
      •    37817: Cancellation holds alert not displayed the correct number of holds [NEW; assigned to koha-bugs]
      •    37728: More "op" are missing in POSTed forms [RESOLVED FIXED; assigned to jonathan.druart] (*)
    •    37785: Remove dead code in tools/letter.tt that looks like a form that would POST without an op [RESOLVED FIXED; assigned to phil]
      •    37728: More "op" are missing in POSTed forms [RESOLVED FIXED; assigned to jonathan.druart] (*)
    •    37827: Switch OPAC download list form from POST to GET [RESOLVED FIXED; assigned to phil]
      •    37728: More "op" are missing in POSTed forms [RESOLVED FIXED; assigned to jonathan.druart] (*)
    •    37853: Returning to your account at the end of changing your password in the OPAC doesn't need to POST a form [RESOLVED FIXED; assigned to phil]
      •    37728: More "op" are missing in POSTed forms [RESOLVED FIXED; assigned to jonathan.druart] (*)
    •    37887: OPAC password recovery needs to use a cud- op while POSTing new password [RESOLVED FIXED; assigned to phil]
      •    37728: More "op" are missing in POSTed forms [RESOLVED FIXED; assigned to jonathan.druart] (*)
    •    37959: Item circulation alerts table appears to be broken [RESOLVED FIXED; assigned to phil]
    •    37961: Inventory followup fails by POSTing without an op or csrf_token [RESOLVED FIXED; assigned to phil]
    •    38309: Cannot delete additional fields [RESOLVED FIXED; assigned to phil]
    •    38328: Cannot delete ILL batch statuses [RESOLVED FIXED; assigned to phil]
    •    38378: Serial frequency deletion is broken [RESOLVED FIXED; assigned to phil]
    •    38463: Unnecessary CSRF token in OPAC authority search [RESOLVED FIXED; assigned to phil] (*)
  •    36177: We need integration tests to cover CSRF checks [CLOSED FIXED; assigned to jonathan.druart]
    •    36355: Auth/csrf.ts is failing if library with long info in the DB [CLOSED FIXED; assigned to jonathan.druart]
  •    36358: Typo in errorpage.tt: requets [CLOSED FIXED; assigned to tomascohen]

Max Depth:

• • Home
  • | New
  • | Browse
  • | Search
  • |
    [?]
  • | Reports
  • | Help
  • | New Account
  • | Log In
    [x]
  • | Forgot Password
    Login: [x]