| Max Depth: |
Bug 36192 depends on 74 bugs:
view as bug list-
36192:
[OMNIBUS] CSRF Protection for Koha
[ASSIGNED; assigned to koha-bugs]
-
34478:
Full CSRF protection
[Pushed to main; assigned to jonathan.druart]
-
34426:
Add tests for CSRF checks missing
[Pushed to main; assigned to martin.renvoize]
-
35890:
AutoLocation system preference + setting the library IP field - can still login and unexpected results
[Pushed to oldoldoldstable; assigned to jonathan.druart]
-
35935:
Wrong branch picked after an incorrect login
[Pushed to stable; assigned to jonathan.druart]
-
35951:
We don't need category-out-of-age-limit.inc
[Pushed to stable; assigned to tomascohen]
-
35955:
New CSRF token generated everytime we need one
[Pushed to oldstable; assigned to dcook]
-
36092:
sessionID not passed to the template on auth.tt
[Pushed to oldstable; assigned to jonathan.druart]
-
36098:
Create Koha::Session module
[Needs documenting; assigned to dcook]
-
30524:
Add base framework for dealing with CSRF in Koha
[CLOSED FIXED; assigned to martin.renvoize]
(*)
-
36017:
Dead code in admin/clone-rules
[RESOLVED FIXED; assigned to jonathan.druart]
-
18936:
Move issuingrules into circulation_rules
[CLOSED FIXED; assigned to jonathan.druart]
-
18930:
Move 'refund lost item fee rules' into the `circulation_rules` table
[CLOSED FIXED; assigned to jonathan.druart]
-
18928:
Move `holdallowed`, `hold_fulfillment_policy` and `returnbranch` into the `circulation_rules` table.
[CLOSED FIXED; assigned to jonathan.druart]
-
18925:
Move maxissueqty and maxonsiteissueqty to circulation_rules
[CLOSED FIXED; assigned to jonathan.druart]
-
22847:
Specific circ rule by patron category is displaying the default (or not displaying)
[CLOSED FIXED; assigned to jonathan.druart]
-
18925:
Move maxissueqty and maxonsiteissueqty to circulation_rules
[CLOSED FIXED; assigned to jonathan.druart]
-
18928:
Move `holdallowed`, `hold_fulfillment_policy` and `returnbranch` into the `circulation_rules` table.
[CLOSED FIXED; assigned to jonathan.druart]
-
18930:
Move 'refund lost item fee rules' into the `circulation_rules` table
[CLOSED FIXED; assigned to jonathan.druart]
-
18936:
Move issuingrules into circulation_rules
[CLOSED FIXED; assigned to jonathan.druart]
-
36019:
Dead code in tags/review
[RESOLVED FIXED; assigned to jonathan.druart]
-
37040:
ErrorDocument accidentally setting off CSRF
[RESOLVED FIXED; assigned to dcook]
-
34426:
Add tests for CSRF checks missing
[Pushed to main; assigned to martin.renvoize]
-
35992:
opac-shareshelf: Accepting invitation should not be triggered directly
[ASSIGNED; assigned to m.de.rooy]
-
36189:
Rewrite www/auth_values_input_www.t using Selenium
[NEW; assigned to chris]
-
36195:
CSRF - testing reports
[NEW; assigned to koha-bugs]
-
36414:
Consequent workflow stages form submit fail due to CSRF token conflict
[Needs documenting; assigned to pedro.amorim]
-
36416:
Check out using CirculateILL is broken
[Needs documenting; assigned to pedro.amorim]
-
36635:
Cannot display vendor's issue
[Needs documenting; assigned to jonathan.druart]
-
37071:
Purchase suggestions from the patron account are not redirecting to the suggestion form
[Needs documenting; assigned to Laura.escamilla]
-
37332:
Renewal due date and renew as unseen fields not respected when renewing an item from the patron account
[Needs documenting; assigned to emily.lamancusa]
-
37385:
Transfer/next hold modals not triggered automatically when cancelling a hold by checking item in
[Needs documenting; assigned to kyle]
-
37407:
Fast add / fast cataloging from patron checkout does not checkout item
[Needs documenting; assigned to blawlor]
-
37429:
Can't edit bibliographic records anymore (empty form)
[Pushed to stable; assigned to jonathan.druart]
-
37483:
Batch extend due dates tool not working
[Needs documenting; assigned to nick]
-
37536:
Cataloging add item js needs to update conditional that checks op
[Needs documenting; assigned to blawlor]
-
37553:
Fix CSRF handling in koha-svc.pl script
[Needs documenting; assigned to dcook]
-
38030:
stocknumberAV.pl fails with CSRF protection
[Pushed to stable; assigned to januszop]
-
38065:
Auto control number (001) widget in advanced editor does not work under CSRF protection
[Pushed to stable; assigned to januszop]
-
38325:
Cannot delete invoice while viewing it
[Pushed to main; assigned to phil]
-
36102:
Protect login forms from CSRF attacks
[RESOLVED FIXED; assigned to jonathan.druart]
(*)
-
36148:
Move CSRF check code outside of CGI->new
[RESOLVED FIXED; assigned to jonathan.druart]
-
36190:
op param for stateful requests must start with 'cud-'
[RESOLVED FIXED; assigned to nick]
-
36193:
CSRF - Code review missed
[RESOLVED FIXED; assigned to koha-bugs]
-
36219:
State parameter broken for OIDC/Oauth
[RESOLVED FIXED; assigned to dcook]
-
36246:
Have a centralized method for submitting a form via a link
[RESOLVED FIXED; assigned to nick]
-
36305:
Inventory tools need adjustments for CSRF
[RESOLVED FIXED; assigned to kyle]
-
36326:
Batch deletion of selected items from detail page is broken
[RESOLVED FIXED; assigned to jonathan.druart]
-
36327:
Items view - Deletion of items is broken
[RESOLVED FIXED; assigned to pedro.amorim]
-
36379:
Authorities search is broken
[RESOLVED FIXED; assigned to phil]
-
36407:
Custom renewal date is not respected when renewing items from the checkouts table
[RESOLVED DUPLICATE; assigned to koha-bugs]
-
36628:
Error 500 when loading pending orders table for receiving on parcel.pl
[RESOLVED INVALID; assigned to koha-bugs]
-
36630:
Item search batch operations buttons broken by CSRF
[RESOLVED FIXED; assigned to blawlor]
-
36634:
tools/automatic_item_modification_by_age.pl use cud-show instead of show
[RESOLVED FIXED; assigned to jonathan.druart]
-
36639:
CSRF: Fix deleting authority from authority detail page
[RESOLVED FIXED; assigned to m.de.rooy]
-
36735:
Cannot revert the waiting status of a hold
[RESOLVED FIXED; assigned to emily.lamancusa]
-
36877:
Patron card creator does not work when editing layout, profile or template
[RESOLVED FIXED; assigned to bibliothek]
-
36931:
label-item-search.pl paging doesn't work (due to CSRF changes)
[RESOLVED FIXED; assigned to dcook]
-
37040:
ErrorDocument accidentally setting off CSRF
[RESOLVED FIXED; assigned to dcook]
(*)
-
37089:
Cannot delete a fund or a currency
[RESOLVED FIXED; assigned to emily.lamancusa]
-
37090:
Cannot delete an EDI account
[RESOLVED FIXED; assigned to emily.lamancusa]
-
37091:
Cannot delete a local system preference
[RESOLVED FIXED; assigned to emily.lamancusa]
-
37111:
OPAC renewal - CSRF "op must be set"
[RESOLVED FIXED; assigned to lucas]
-
37127:
Authorized values select not working on authority forms
[RESOLVED FIXED; assigned to phil]
-
37129:
Patron attributes linked to an authorized value don't show a select menu in batch modification
[RESOLVED FIXED; assigned to phil]
-
37152:
Delete-confirm should not start with 'cud-'
[RESOLVED FIXED; assigned to phil]
-
37161:
After deleting a tag in a MARC framework, confirmation page is blank
[RESOLVED FIXED; assigned to phil]
-
37165:
Can't edit frequencies due to stray cud- in modify op
[RESOLVED FIXED; assigned to phil]
-
37377:
Orders search is not returning any results
[RESOLVED FIXED; assigned to blawlor]
-
37612:
Batch modifying patrons from patron lists broken by CSRF protection
[RESOLVED FIXED; assigned to phil]
-
37614:
Printing patron cards from patron lists broken by CSRF protection
[RESOLVED FIXED; assigned to phil]
-
34478:
Full CSRF protection
[Pushed to main; assigned to jonathan.druart]
Bug 36192 blocks 44 bugs:
view as bug list-
36192:
[OMNIBUS] CSRF Protection for Koha
[ASSIGNED; assigned to koha-bugs]
-
37206:
Removing an item from a label batch should be a CSRF-protected POST operation
[Pushed to stable; assigned to oleonard]
-
37235:
Download single authority results in 500 error
[Pushed to stable; assigned to oleonard]
-
37263:
Creating default article request fees is not working
[Pushed to stable; assigned to pedro.amorim]
-
37270:
Deleting a report from the actions menu on a list of saved reports does not work
[Needs documenting; assigned to oleonard]
-
37489:
Cannot delete patron image without uploading a file
[Needs documenting; assigned to samalau]
-
37580:
Unique holiday descriptions are not editable
[Pushed to stable; assigned to cj.lynce]
-
37741:
Koha errors on page (e.g. 404) cause incorrect CSRF errors
[Pushed to stable; assigned to dcook]
-
37766:
Fix forms that POST without an op in MARC bibliographic frameworks
[Pushed to stable; assigned to phil]
-
37794:
Fix form that POSTs without an op in Holds to pull
[Pushed to stable; assigned to phil]
-
37827:
Switch OPAC download list form from POST to GET
[Pushed to stable; assigned to phil]
-
37853:
Returning to your account at the end of changing your password in the OPAC doesn't need to POST a form
[Pushed to stable; assigned to phil]
-
37887:
OPAC password recovery needs to use a cud- op while POSTing new password
[Pushed to stable; assigned to phil]
-
37914:
Forms for budget planning filters and export should GET rather than POST
[Pushed to stable; assigned to phil]
-
37916:
Plugin search and install regression
[Pushed to stable; assigned to martin.renvoize]
-
37993:
Having a single EDI EAN account produces a bad redirect
[NEW; assigned to koha-bugs]
-
38275:
Unable to delete patron card creator images
[Pushed to main; assigned to dcook]
-
38309:
Cannot delete additional fields
[Pushed to main; assigned to phil]
-
38328:
Cannot delete ILL batch statuses
[Pushed to main; assigned to phil]
-
38378:
Serial frequency deletion is broken
[Pushed to main; assigned to phil]
-
38463:
Unnecessary CSRF token in OPAC authority search
[Pushed to main; assigned to phil]
-
36597:
Cannot delete circulation desk
[RESOLVED FIXED; assigned to oleonard]
-
36598:
Add CSRF protection to Mojolicious apps
[RESOLVED FIXED; assigned to julian.maurice]
-
37069:
Authorities pagination on OPAC broken by CSRF
[RESOLVED FIXED; assigned to nick]
-
37080:
Cannot delete a MARC bibliographic framework or authority type
[RESOLVED FIXED; assigned to phil]
-
37093:
403 Forbidden Error when attempting to search for Mana Reports
[RESOLVED FIXED; assigned to phil]
-
37187:
Label batches and label templates cannot be deleted
[RESOLVED FIXED; assigned to oleonard]
-
37192:
Can't print label from the item editor
[RESOLVED FIXED; assigned to lucas]
-
37197:
Batch patron modification from reports fails by using GET instead of POST
[RESOLVED FIXED; assigned to phil]
-
37188:
Batch patron modification from report results should be an option when borrowernumber is selected
[Needs documenting; assigned to nick]
-
37481:
Some operations that do not affect data should be submitted as POST requests
[NEW; assigned to koha-bugs]
-
37615:
Clean up the form for sending cardnumbers from a report to batch patron modification
[RESOLVED FIXED; assigned to phil]
-
37188:
Batch patron modification from report results should be an option when borrowernumber is selected
[Needs documenting; assigned to nick]
-
37409:
Edit button for items in course reserves list doesn't work
[RESOLVED FIXED; assigned to samalau]
-
37728:
More "op" are missing in POSTed forms
[RESOLVED FIXED; assigned to jonathan.druart]
(*)
-
37765:
Fix forms that POST without an op in systempreferences
[RESOLVED FIXED; assigned to phil]
-
37767:
Fix forms that POST without an op in Authority types
[RESOLVED FIXED; assigned to phil]
-
37768:
Fix form that POSTs without an op in itemtype administration
[RESOLVED FIXED; assigned to phil]
-
37769:
Fix forms that POST without an op in currency administration
[RESOLVED FIXED; assigned to phil]
-
37779:
Fix forms that POST without an op in tag moderation
[RESOLVED FIXED; assigned to phil]
-
37783:
Fix form that looks like it would POST without an op in reserve/request.tt
[RESOLVED FIXED; assigned to phil]
-
37785:
Remove dead code in tools/letter.tt that looks like a form that would POST without an op
[RESOLVED FIXED; assigned to phil]
-
37959:
Item circulation alerts table appears to be broken
[RESOLVED FIXED; assigned to phil]
-
37961:
Inventory followup fails by POSTing without an op or csrf_token
[RESOLVED FIXED; assigned to phil]
-
37206:
Removing an item from a label batch should be a CSRF-protected POST operation
[Pushed to stable; assigned to oleonard]
| Max Depth: |