Bug 34478: Manual fix - action to op / add cud- - opac-search-history

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - change action to op and fix transport type - pos/pay

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - update ops and use forms - editCollections

Bug 34478: TO SQUASH - Manual fix editCollections

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Add 'op' to opac-sendbasketform

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Add 'op' to opac-ratings

This is only for non-JS, might need to be removed

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Add 'op' to opac-tags

There are way more to do in this controller!...

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Add 'op' to opac-request-article

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Add 'op' to opac-messaging

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Remove no longer used Mana comment form

The form was moved and cleaned up but it appears during rebases the
original got re-introduced.  This just tidies it up as the form itself
here is never used or displayed.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Rename action with op - offline_circ

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Add missing op - members-update

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Rename action with op - mod_debarment

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Rename action with op - opac-issue-note

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: op modify=>edit_form, add=>add_form - memberentry.pl

Bug 34478: TO SQUASH op modify=>edit_form, add=>add_form ( pass opadd to template )- memberentry.pl

The template expects opadd when showing the form - along the way it was changed to 'add' and broke new patron
entry

Bug 34478: TO SQUASH op modify=>edit_form, add=>add_form ( pass op to template )- memberentry.pl

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: op=modify should be op=add_form - memberentry.pl

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: actionType parameter not used - memberentry.pl

Bug 34478: [TO SQUASH] actionType parameter not used - memberentry.pl

syntax error at members/memberentry.pl line 103, near "\|"

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - problem_reports

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Replace POST with GET - request.tt

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Rename action with op - members/boraccount

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - Course reserves

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - opac-shareshelf

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - opac-shelves (WIP)

Share still needs attention, moved to "later"

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Log if CSRF is wrong (debug)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Fix new forms

New forms that need to be fixed after rebase.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: op =~ ^cud- in pl/pm - Manual branches.pl

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Rename action with op - import_export_framework

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - Batch rm items (course reserves)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - Batch add items (course reserves)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - Add items (course reserves)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - change to post - guided_reports

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - change to post remove cud from confirm step - serials-collection

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - remove cud from search op - authorities-home

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - Switch to post, update op - neworderempty_duplicate

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - Switch to post, update op, add missing include - basket

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - fix ops and method - deletemem

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - Rename action with op change to post - merge-patrons

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Rename action with op - circ/request-article

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Rename action with op - circ/checkout-notes

svc/checkout_notes will need to be adjusted as well

Bug 34478: [TO SQUASH] Rename action with op - circ/checkout-notes

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Rename action with op - catalogue/search-history

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Rename action with op - admin/library_groups

This is a bit dirty but it works.
form is not styling correctly when put within the li

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Rename action with op - admin/item_circulation_alerts

Also fix possible XSS.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Rename action with op - admin/columns_settings

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Rename action with op - acqui/cancelorder

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Remove no longer reference form

Cleanup whilst we're here.. the form here isn't actually included
anywhere and the acompanying controller no longer exists.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Update label ops 'edit' to 'edit_form'

This serves to clarify that the 'edit' is not an update action in this
case, but instead is a form fetch.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: op =~ ^cud- in pl/pm - Manual parcels.pl

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - preferences

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: op =~ ^cud- in pl/pm - Manual preferences.pl

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Add method="get" to forms without method

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Remove duplicated form in virtualshelves/downloadshelf.tt

Just... don't ask... It's there since 2010

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - label-edit-profile (cud-save)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - label-edit-template (cud-save)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - label-edit-layout (cud-save)

Also updated 'cud-edit' in the controller back to 'edit' as it's a 'get'
request to display the form.. i.e. read not create, write or update.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - subscription-nuberpatterns (cud-del)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix  - subscription-frequencies (cud-del)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - parcels.pl (cud-confirm cud-new)

Bug 34478: [TO SQUASH] Manual fix - parcels.pl (cud-confirm cud-new)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - edi_ean (cud-ediorder)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - basketgroups

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - account refund - Add op param to forms

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - delete baskets - Add csrf include

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - delete baskets

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - account line discount

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - account refund

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - account payout

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Display programming errors in case plack.psgi caught something suspicious

It will help developpers to debug the problematic places.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - duplicate_orders (cud-select)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - preferences

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - memberentry (modify)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - batchMod

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: op =~ ^cud- in pl/pm

This is the result of
  bash op_must_start_with_cud-perl.sh

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - additem

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - opac-suggestions

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Replace POST with GET when needed - add_form

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Adjust selenium tests

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Add missing csrf-token.inc for opac

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: op =~ ^cud- everywhere

This is the result of
  perl op_must_start_with_cud.pl

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: op =~ ^cud-

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: op-cud - Trick CGI directly

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: op-cud - Rename op with op-cud in templates

This is the result of
  perl rename_op_with_op-cud.pl

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: op-cud - Adjust C4::Auth code

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Move C4::Auth check

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Remove check_csrf from pl files

We should no longer need to check CSRF token from pl files

TODO - there is a change for some files where we returned 403

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Check CSRF in get_template_and_user

Not sure this is the right place in get_template_and_user
Will have to test login and 2FA

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Add 'op' to opac-passwd

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Add 'op' to opac-user.tt

Bug 34478: [TO SQUASH] Add 'op' to opac-user.tt

Bug 34478: [TO SQUASH] Add 'op' to opac-user.tt

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Add missing CSRF token to POST forms

This is the result of
  % perl csrf_add_missing_csrf.pl

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Remove generate_csrf from pl

We do not longer need to generate_csrf from pl files

TODO - members/boraccount.tt and sco/sco-main.tt needs to be adjusted

Bug 34478: [TO SQUASH] Remove generate_csrf from pl

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Replace csrf_token input with include file - manual

A couple of left not caught by the previous regex

Still TODO:
% git grep csrf_token **/*.inc **/*.tt
still shows example that needs to be replaced, later (because we use GET)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Replace csrf_token input with include file

perl -p -i -n -e 's#<input type="hidden" name="csrf_token" value="\[% csrf_token \| html %]" />#[% INCLUDE '\''csrf-token.inc'\'' %]#g' **/*.tt **/*.inc

This should have actually been done at the same time as
  "Bug 30524: (QA follow-up) Only generate CSRF token if it will be used"

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Replace get with post when needed

This is what has been marked as done in "csrf_get.txt"

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 35955: Add tests

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 35955: Cache CSRF token in template plugin

This change uses the Koha::Cache::Memory::Lite cache to
cache the CSRF token, so that it is only generated once,
and is re-used by the Koha::Template::Plugin::Koha object
throughout the entire template processing for the HTTP request.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 36098: Default to 'file' if pref does not exist

During the installer process there is a bunch of warnings
  "Use of uninitialized value $storage_method in string eq at"

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 36098: (follow-up) extend test to check driver

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 36098: Fix storage_method pass

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 36098: Allow to pass storage_method

Will need this on follow-up bugs.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 36098: (QA follow-up) Add POD to Koha::Session

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 36098: Add Koha::Session module to ease session handling

This patch adds a Koha::Session module that makes it easier
to work with Koha sessions without needing the full C4::Auth module.

Test plan:
0. Apply the patch
1. Run the following unit tests:
prove ./t/db_dependent/Auth.t
prove ./t/db_dependent/Auth_with_cas.t
prove ./t/db_dependent/Koha/Session.t
2. Observe that they all pass

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 35935: Ensure login branch will be used after incorrect login

If a different branch is selected after an incorrect login, the previous
branch will be used.

To recreate:
* login with foo/bar, select CPL => FAIL
* login with koha/koha, select another branch => OK but CPL is picked!

It was caused by a dup of "branch" in CGI param list (and first was
picked).

This patch patch also removes "koha_login_context" to not have it twice.
You can also open the source of the page to confirm that form#loginform
contains "branch" and "koha_login_context" in hidden inputs.

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Tested in KTD. Works as advertised.
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 36092: Pass sessionID at the end of get_template_and_user

It seems safer to pass the logged in user and session info at the end of
the sub.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>