| Max Depth: |
Bug 36326 depends on 24 bugs:
view as bug list-
36326:
Batch deletion of selected items from detail page is broken
[RESOLVED FIXED; assigned to jonathan.druart]
-
34478:
Full CSRF protection
[Pushed to main; assigned to jonathan.druart]
-
34426:
Add tests for CSRF checks missing
[Pushed to main; assigned to martin.renvoize]
-
35890:
AutoLocation system preference + setting the library IP field - can still login and unexpected results
[Pushed to oldoldoldstable; assigned to jonathan.druart]
-
35935:
Wrong branch picked after an incorrect login
[Pushed to stable; assigned to jonathan.druart]
-
35951:
We don't need category-out-of-age-limit.inc
[Pushed to stable; assigned to tomascohen]
-
35955:
New CSRF token generated everytime we need one
[Pushed to oldstable; assigned to dcook]
-
36092:
sessionID not passed to the template on auth.tt
[Pushed to oldstable; assigned to jonathan.druart]
-
36098:
Create Koha::Session module
[Needs documenting; assigned to dcook]
-
30524:
Add base framework for dealing with CSRF in Koha
[CLOSED FIXED; assigned to martin.renvoize]
(*)
-
36017:
Dead code in admin/clone-rules
[RESOLVED FIXED; assigned to jonathan.druart]
-
18936:
Move issuingrules into circulation_rules
[CLOSED FIXED; assigned to jonathan.druart]
-
18930:
Move 'refund lost item fee rules' into the `circulation_rules` table
[CLOSED FIXED; assigned to jonathan.druart]
-
18928:
Move `holdallowed`, `hold_fulfillment_policy` and `returnbranch` into the `circulation_rules` table.
[CLOSED FIXED; assigned to jonathan.druart]
-
18925:
Move maxissueqty and maxonsiteissueqty to circulation_rules
[CLOSED FIXED; assigned to jonathan.druart]
-
22847:
Specific circ rule by patron category is displaying the default (or not displaying)
[CLOSED FIXED; assigned to jonathan.druart]
-
18925:
Move maxissueqty and maxonsiteissueqty to circulation_rules
[CLOSED FIXED; assigned to jonathan.druart]
-
18928:
Move `holdallowed`, `hold_fulfillment_policy` and `returnbranch` into the `circulation_rules` table.
[CLOSED FIXED; assigned to jonathan.druart]
-
18930:
Move 'refund lost item fee rules' into the `circulation_rules` table
[CLOSED FIXED; assigned to jonathan.druart]
-
18936:
Move issuingrules into circulation_rules
[CLOSED FIXED; assigned to jonathan.druart]
-
36019:
Dead code in tags/review
[RESOLVED FIXED; assigned to jonathan.druart]
-
37040:
ErrorDocument accidentally setting off CSRF
[RESOLVED FIXED; assigned to dcook]
-
34426:
Add tests for CSRF checks missing
[Pushed to main; assigned to martin.renvoize]
-
34478:
Full CSRF protection
[Pushed to main; assigned to jonathan.druart]
Bug 36326 blocks 45 bugs:
view as bug list-
36326:
Batch deletion of selected items from detail page is broken
[RESOLVED FIXED; assigned to jonathan.druart]
-
36192:
[OMNIBUS] CSRF Protection for Koha
[ASSIGNED; assigned to koha-bugs]
-
37206:
Removing an item from a label batch should be a CSRF-protected POST operation
[Pushed to stable; assigned to oleonard]
-
37235:
Download single authority results in 500 error
[Pushed to stable; assigned to oleonard]
-
37263:
Creating default article request fees is not working
[Pushed to stable; assigned to pedro.amorim]
-
37270:
Deleting a report from the actions menu on a list of saved reports does not work
[Needs documenting; assigned to oleonard]
-
37489:
Cannot delete patron image without uploading a file
[Needs documenting; assigned to samalau]
-
37580:
Unique holiday descriptions are not editable
[Pushed to stable; assigned to cj.lynce]
-
37741:
Koha errors on page (e.g. 404) cause incorrect CSRF errors
[Pushed to stable; assigned to dcook]
-
37766:
Fix forms that POST without an op in MARC bibliographic frameworks
[Pushed to stable; assigned to phil]
-
37794:
Fix form that POSTs without an op in Holds to pull
[Pushed to stable; assigned to phil]
-
37827:
Switch OPAC download list form from POST to GET
[Pushed to stable; assigned to phil]
-
37853:
Returning to your account at the end of changing your password in the OPAC doesn't need to POST a form
[Pushed to stable; assigned to phil]
-
37887:
OPAC password recovery needs to use a cud- op while POSTing new password
[Pushed to stable; assigned to phil]
-
37914:
Forms for budget planning filters and export should GET rather than POST
[Pushed to stable; assigned to phil]
-
37916:
Plugin search and install regression
[Pushed to stable; assigned to martin.renvoize]
-
37993:
Having a single EDI EAN account produces a bad redirect
[NEW; assigned to koha-bugs]
-
38275:
Unable to delete patron card creator images
[Pushed to main; assigned to dcook]
-
38309:
Cannot delete additional fields
[Pushed to main; assigned to phil]
-
38328:
Cannot delete ILL batch statuses
[Pushed to main; assigned to phil]
-
38378:
Serial frequency deletion is broken
[Pushed to main; assigned to phil]
-
38463:
Unnecessary CSRF token in OPAC authority search
[Pushed to main; assigned to phil]
-
36597:
Cannot delete circulation desk
[RESOLVED FIXED; assigned to oleonard]
-
36598:
Add CSRF protection to Mojolicious apps
[RESOLVED FIXED; assigned to julian.maurice]
-
37069:
Authorities pagination on OPAC broken by CSRF
[RESOLVED FIXED; assigned to nick]
-
37080:
Cannot delete a MARC bibliographic framework or authority type
[RESOLVED FIXED; assigned to phil]
-
37093:
403 Forbidden Error when attempting to search for Mana Reports
[RESOLVED FIXED; assigned to phil]
-
37187:
Label batches and label templates cannot be deleted
[RESOLVED FIXED; assigned to oleonard]
-
37192:
Can't print label from the item editor
[RESOLVED FIXED; assigned to lucas]
-
37197:
Batch patron modification from reports fails by using GET instead of POST
[RESOLVED FIXED; assigned to phil]
-
37188:
Batch patron modification from report results should be an option when borrowernumber is selected
[Needs documenting; assigned to nick]
-
37481:
Some operations that do not affect data should be submitted as POST requests
[NEW; assigned to koha-bugs]
-
37615:
Clean up the form for sending cardnumbers from a report to batch patron modification
[RESOLVED FIXED; assigned to phil]
-
37188:
Batch patron modification from report results should be an option when borrowernumber is selected
[Needs documenting; assigned to nick]
-
37409:
Edit button for items in course reserves list doesn't work
[RESOLVED FIXED; assigned to samalau]
-
37728:
More "op" are missing in POSTed forms
[RESOLVED FIXED; assigned to jonathan.druart]
(*)
-
37765:
Fix forms that POST without an op in systempreferences
[RESOLVED FIXED; assigned to phil]
-
37767:
Fix forms that POST without an op in Authority types
[RESOLVED FIXED; assigned to phil]
-
37768:
Fix form that POSTs without an op in itemtype administration
[RESOLVED FIXED; assigned to phil]
-
37769:
Fix forms that POST without an op in currency administration
[RESOLVED FIXED; assigned to phil]
-
37779:
Fix forms that POST without an op in tag moderation
[RESOLVED FIXED; assigned to phil]
-
37783:
Fix form that looks like it would POST without an op in reserve/request.tt
[RESOLVED FIXED; assigned to phil]
-
37785:
Remove dead code in tools/letter.tt that looks like a form that would POST without an op
[RESOLVED FIXED; assigned to phil]
-
37959:
Item circulation alerts table appears to be broken
[RESOLVED FIXED; assigned to phil]
-
37961:
Inventory followup fails by POSTing without an op or csrf_token
[RESOLVED FIXED; assigned to phil]
-
37206:
Removing an item from a label batch should be a CSRF-protected POST operation
[Pushed to stable; assigned to oleonard]
-
36192:
[OMNIBUS] CSRF Protection for Koha
[ASSIGNED; assigned to koha-bugs]
| Max Depth: |