Max Depth:

Bug 37765 depends on 75 bugs:

view as bug list

•    37765: Fix forms that POST without an op in systempreferences [Pushed to main; assigned to phil]
  •    36192: [OMNIBUS] CSRF Protection for Koha [ASSIGNED; assigned to koha-bugs]
    •    34478: Full CSRF protection [Pushed to main; assigned to jonathan.druart]
      •    34426: Add tests for CSRF checks missing [Pushed to main; assigned to martin.renvoize]
        •    30524: Add base framework for dealing with CSRF in Koha [CLOSED FIXED; assigned to martin.renvoize]
      •    35890: AutoLocation system preference + setting the library IP field - can still login and unexpected results [Pushed to oldoldoldstable; assigned to jonathan.druart]
        •    35904: C4::Auth::checkauth cannot be tested easily [Pushed to oldstable; assigned to jonathan.druart]
      •    35935: Wrong branch picked after an incorrect login [Pushed to stable; assigned to jonathan.druart]
      •    35951: We don't need category-out-of-age-limit.inc [Pushed to stable; assigned to tomascohen]
      •    35955: New CSRF token generated everytime we need one [Pushed to stable; assigned to dcook]
      •    36092: sessionID not passed to the template on auth.tt [Pushed to oldstable; assigned to jonathan.druart]
        •    35890: AutoLocation system preference + setting the library IP field - can still login and unexpected results [Pushed to oldoldoldstable; assigned to jonathan.druart] (*)
      •    36098: Create Koha::Session module [Pushed to oldoldstable; assigned to dcook]
      •    30524: Add base framework for dealing with CSRF in Koha [CLOSED FIXED; assigned to martin.renvoize] (*)
      •    36017: Dead code in admin/clone-rules [RESOLVED FIXED; assigned to jonathan.druart]
        •    18936: Move issuingrules into circulation_rules [CLOSED FIXED; assigned to jonathan.druart]
          •    18930: Move 'refund lost item fee rules' into the `circulation_rules` table [CLOSED FIXED; assigned to jonathan.druart]
            •    18928: Move `holdallowed`, `hold_fulfillment_policy` and `returnbranch` into the `circulation_rules` table. [CLOSED FIXED; assigned to jonathan.druart]
              •    18925: Move maxissueqty and maxonsiteissueqty to circulation_rules [CLOSED FIXED; assigned to jonathan.druart]
                •    18887: Introduce new table 'circulation_rules', use for 'max_holds' rules [CLOSED FIXED; assigned to jonathan.druart]
                  •    15524: Set limit on maximum possible holds per patron by category [CLOSED FIXED; assigned to kyle]
                    •    20227: admin/smart-rules.pl should pass categorycode instead of branchcode [CLOSED FIXED; assigned to m.de.rooy]
                      •    2000: separation of issuing & fines rules breaks defaults propagation [CLOSED FIXED; assigned to gmcharlt]
              •    22847: Specific circ rule by patron category is displaying the default (or not displaying) [CLOSED FIXED; assigned to jonathan.druart]
                •    18887: Introduce new table 'circulation_rules', use for 'max_holds' rules [CLOSED FIXED; assigned to jonathan.druart] (*)
                •    18925: Move maxissueqty and maxonsiteissueqty to circulation_rules [CLOSED FIXED; assigned to jonathan.druart] (*)
      •    36019: Dead code in tags/review [RESOLVED FIXED; assigned to jonathan.druart]
        •    20489: Prevent DB user login [CLOSED FIXED; assigned to jonathan.druart]
          •    20580: create_superlibrarian.pl should accept parameters [CLOSED FIXED; assigned to jonathan.druart]
      •    37040: ErrorDocument accidentally setting off CSRF [RESOLVED FIXED; assigned to dcook]
    •    35992: opac-shareshelf: Accepting invitation should not be triggered directly [ASSIGNED; assigned to m.de.rooy]
      •    34478: Full CSRF protection [Pushed to main; assigned to jonathan.druart] (*)
      •    35445: OPAC registration verification triggered by email URL scanners [Pushed to stable; assigned to dcook]
    •    36189: Rewrite www/auth_values_input_www.t using Selenium [NEW; assigned to chris]
      •    34478: Full CSRF protection [Pushed to main; assigned to jonathan.druart] (*)
    •    36195: CSRF - testing reports [NEW; assigned to koha-bugs]
      •    34478: Full CSRF protection [Pushed to main; assigned to jonathan.druart] (*)
    •    36414: Consequent workflow stages form submit fail due to CSRF token conflict [Needs documenting; assigned to pedro.amorim]
    •    36416: Check out using CirculateILL is broken [Needs documenting; assigned to pedro.amorim]
    •    36635: Cannot display vendor's issue [Needs documenting; assigned to jonathan.druart]
    •    37071: Purchase suggestions from the patron account are not redirecting to the suggestion form [Needs documenting; assigned to Laura.escamilla]
    •    37111: OPAC renewal - CSRF "op must be set" [Needs documenting; assigned to lucas]
      •    34478: Full CSRF protection [Pushed to main; assigned to jonathan.druart] (*)
      •    36246: Have a centralized method for submitting a form via a link [RESOLVED FIXED; assigned to nick]
    •    37332: Renewal due date and renew as unseen fields not respected when renewing an item from the patron account [Needs documenting; assigned to emily.lamancusa]
      •    36084: Pass CSRF token to SVC scripts (1/2) [RESOLVED FIXED; assigned to jonathan.druart]
        •    36102: Protect login forms from CSRF attacks [RESOLVED FIXED; assigned to jonathan.druart]
          •    34478: Full CSRF protection [Pushed to main; assigned to jonathan.druart] (*)
    •    37385: Transfer/next hold modals not triggered automatically when cancelling a hold by checking item in [Needs documenting; assigned to kyle]
    •    37407: Fast add / fast cataloging from patron checkout does not checkout item [Needs documenting; assigned to blawlor]
    •    37429: Can't edit bibliographic records anymore (empty form) [Pushed to stable; assigned to jonathan.druart]
    •    37483: Batch extend due dates tool not working [Needs documenting; assigned to nick]
      •    34478: Full CSRF protection [Pushed to main; assigned to jonathan.druart] (*)
    •    37536: Cataloging add item js needs to update conditional that checks op [Needs documenting; assigned to blawlor]
    •    37553: Fix CSRF handling in koha-svc.pl script [Needs documenting; assigned to dcook]
    •    38030: stocknumberAV.pl fails with CSRF protection [Pushed to main; assigned to januszop]
    •    38065: Auto control number (001) widget in advanced editor does not work under CSRF protection [Pushed to main; assigned to januszop]
    •    38325: Cannot delete invoice while viewing it [Signed Off; assigned to phil]
    •    36102: Protect login forms from CSRF attacks [RESOLVED FIXED; assigned to jonathan.druart] (*)
    •    36148: Move CSRF check code outside of CGI->new [RESOLVED FIXED; assigned to jonathan.druart]
      •    34478: Full CSRF protection [Pushed to main; assigned to jonathan.druart] (*)
    •    36190: op param for stateful requests must start with 'cud-' [RESOLVED FIXED; assigned to nick]
      •    34478: Full CSRF protection [Pushed to main; assigned to jonathan.druart] (*)
    •    36193: CSRF - Code review missed [RESOLVED FIXED; assigned to koha-bugs]
      •    34478: Full CSRF protection [Pushed to main; assigned to jonathan.druart] (*)
    •    36219: State parameter broken for OIDC/Oauth [RESOLVED FIXED; assigned to dcook]
      •    34478: Full CSRF protection [Pushed to main; assigned to jonathan.druart] (*)
    •    36246: Have a centralized method for submitting a form via a link [RESOLVED FIXED; assigned to nick] (*)
    •    36305: Inventory tools need adjustments for CSRF [RESOLVED FIXED; assigned to kyle]
    •    36326: Batch deletion of selected items from detail page is broken [RESOLVED FIXED; assigned to jonathan.druart]
      •    34478: Full CSRF protection [Pushed to main; assigned to jonathan.druart] (*)
    •    36327: Items view - Deletion of items is broken [RESOLVED FIXED; assigned to pedro.amorim]
    •    36379: Authorities search is broken [RESOLVED FIXED; assigned to phil]
    •    36407: Custom renewal date is not respected when renewing items from the checkouts table [RESOLVED DUPLICATE; assigned to koha-bugs]
      •    36084: Pass CSRF token to SVC scripts (1/2) [RESOLVED FIXED; assigned to jonathan.druart] (*)
    •    36628: Error 500 when loading pending orders table for receiving on parcel.pl [RESOLVED INVALID; assigned to koha-bugs]
    •    36630: Item search batch operations buttons broken by CSRF [RESOLVED FIXED; assigned to blawlor]
      •    34478: Full CSRF protection [Pushed to main; assigned to jonathan.druart] (*)
    •    36634: tools/automatic_item_modification_by_age.pl use cud-show instead of show [RESOLVED FIXED; assigned to jonathan.druart]
    •    36639: CSRF: Fix deleting authority from authority detail page [RESOLVED FIXED; assigned to m.de.rooy]
    •    36735: Cannot revert the waiting status of a hold [RESOLVED FIXED; assigned to emily.lamancusa]
      •    36246: Have a centralized method for submitting a form via a link [RESOLVED FIXED; assigned to nick] (*)
    •    36877: Patron card creator does not work when editing layout, profile or template [RESOLVED FIXED; assigned to bibliothek]
      •    34478: Full CSRF protection [Pushed to main; assigned to jonathan.druart] (*)
    •    36931: label-item-search.pl paging doesn't work (due to CSRF changes) [RESOLVED FIXED; assigned to dcook]
    •    37040: ErrorDocument accidentally setting off CSRF [RESOLVED FIXED; assigned to dcook] (*)
    •    37089: Cannot delete a fund or a currency [RESOLVED FIXED; assigned to emily.lamancusa]
    •    37090: Cannot delete an EDI account [RESOLVED FIXED; assigned to emily.lamancusa]
    •    37091: Cannot delete a local system preference [RESOLVED FIXED; assigned to emily.lamancusa]
    •    37127: Authorized values select not working on authority forms [RESOLVED FIXED; assigned to phil]
    •    37129: Patron attributes linked to an authorized value don't show a select menu in batch modification [RESOLVED FIXED; assigned to phil]
    •    37152: Delete-confirm should not start with 'cud-' [RESOLVED FIXED; assigned to phil]
    •    37161: After deleting a tag in a MARC framework, confirmation page is blank [RESOLVED FIXED; assigned to phil]
    •    37165: Can't edit frequencies due to stray cud- in modify op [RESOLVED FIXED; assigned to phil]
    •    37377: Orders search is not returning any results [RESOLVED FIXED; assigned to blawlor]
    •    37612: Batch modifying patrons from patron lists broken by CSRF protection [RESOLVED FIXED; assigned to phil]
    •    37614: Printing patron cards from patron lists broken by CSRF protection [RESOLVED FIXED; assigned to phil]

Bug 37765 blocks one bug:

view as bug list

•    37765: Fix forms that POST without an op in systempreferences [Pushed to main; assigned to phil]
  •    37728: More "op" are missing in POSTed forms [Pushed to main; assigned to jonathan.druart]

Max Depth:

• • Home
  • | New
  • | Browse
  • | Search
  • |
    [?]
  • | Reports
  • | Help
  • | New Account
  • | Log In
    [x]
  • | Forgot Password
    Login: [x]