View | Details | Raw Unified | Return to bug 22990
Collapse All | Expand All

(-)a/circ/add_message.pl (+1 lines)
Lines 34-39 my ( $template, $loggedinuser, $cookie ) = get_template_and_user( Link Here
34
        flagsrequired   => { borrowers => 'edit_borrowers' },
34
        flagsrequired   => { borrowers => 'edit_borrowers' },
35
    }
35
    }
36
);
36
);
37
output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
37
38
38
my $borrowernumber   = $input->param('borrowernumber');
39
my $borrowernumber   = $input->param('borrowernumber');
39
my $branchcode       = $input->param('branchcode');
40
my $branchcode       = $input->param('branchcode');
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc (+1 lines)
Lines 109-114 Link Here
109
    <div class="modal-dialog">
109
    <div class="modal-dialog">
110
        <div class="modal-content">
110
        <div class="modal-content">
111
            <form method="post" action="/cgi-bin/koha/circ/add_message.pl" id="message_form" name="message_f">
111
            <form method="post" action="/cgi-bin/koha/circ/add_message.pl" id="message_form" name="message_f">
112
                [% INCLUDE 'csrf-token.inc' %]
112
                <div class="modal-header">
113
                <div class="modal-header">
113
                    <h3>Leave a message</h3>
114
                    <h3>Leave a message</h3>
114
                </div>
115
                </div>
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt (+4 lines)
Lines 212-217 Link Here
212
                <h1>Transfer ownership of public list [% shelf.shelfname | html %]</h1>
212
                <h1>Transfer ownership of public list [% shelf.shelfname | html %]</h1>
213
213
214
                <form action="/cgi-bin/koha/virtualshelves/shelves.pl" id="transferform" method="post">
214
                <form action="/cgi-bin/koha/virtualshelves/shelves.pl" id="transferform" method="post">
215
                    [% INCLUDE 'csrf-token.inc' %]
215
                    <fieldset>
216
                    <fieldset>
216
                        <input type="hidden" name="op" value="transfer" />
217
                        <input type="hidden" name="op" value="transfer" />
217
                        <input type="hidden" name="public" value="1" />
218
                        <input type="hidden" name="public" value="1" />
Lines 244-249 Link Here
244
                [% IF itemsloop %]
245
                [% IF itemsloop %]
245
                    <div class="pages">[% pagination_bar | $raw %]</div>
246
                    <div class="pages">[% pagination_bar | $raw %]</div>
246
                    <form action="/cgi-bin/koha/virtualshelves/shelves.pl" id="listform" method="post">
247
                    <form action="/cgi-bin/koha/virtualshelves/shelves.pl" id="listform" method="post">
248
                        [% INCLUDE 'csrf-token.inc' %]
247
                        <input type="hidden" name="op" value="remove_biblios" />
249
                        <input type="hidden" name="op" value="remove_biblios" />
248
                        <input type="hidden" name="referer" value="view" />
250
                        <input type="hidden" name="referer" value="view" />
249
                        <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]" />
251
                        <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]" />
Lines 392-397 Link Here
392
            [% IF op == 'add_form' OR op == 'edit_form' %]
394
            [% IF op == 'add_form' OR op == 'edit_form' %]
393
395
394
                <form method="post" action="/cgi-bin/koha/virtualshelves/shelves.pl" class="validated">
396
                <form method="post" action="/cgi-bin/koha/virtualshelves/shelves.pl" class="validated">
397
                    [% INCLUDE 'csrf-token.inc' %]
395
                    <fieldset class="rows">
398
                    <fieldset class="rows">
396
                        [% IF op == 'add_form' %]
399
                        [% IF op == 'add_form' %]
397
                            <legend><h1>Create a new list</h1></legend>
400
                            <legend><h1>Create a new list</h1></legend>
Lines 551-556 Link Here
551
    <div class="modal" id="addToList" tabindex="-1" role="dialog" aria-labelledby="addToListLabel">
554
    <div class="modal" id="addToList" tabindex="-1" role="dialog" aria-labelledby="addToListLabel">
552
        <div class="modal-dialog" role="document">
555
        <div class="modal-dialog" role="document">
553
            <form action="/cgi-bin/koha/virtualshelves/shelves.pl" method="post">
556
            <form action="/cgi-bin/koha/virtualshelves/shelves.pl" method="post">
557
                [% INCLUDE 'csrf-token.inc' %]
554
                <div class="modal-content">
558
                <div class="modal-content">
555
                    <div class="modal-header">
559
                    <div class="modal-header">
556
                        <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
560
                        <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt (+3 lines)
Lines 39-44 Link Here
39
    [%~ public      = public | html ~%]
39
    [%~ public      = public | html ~%]
40
    [%~ IF can_manage_shelf ~%]
40
    [%~ IF can_manage_shelf ~%]
41
        [%~ action_block =                '<form action="shelves.pl" method="get">' ~%]
41
        [%~ action_block =                '<form action="shelves.pl" method="get">' ~%]
42
        [%~ action_block = BLOCK ~%][%~ action_block | $raw ~%][%~ INCLUDE 'csrf-token.inc' | trim ~%][%~ END ~%]
42
        [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber  _ '" />' ~%]
43
        [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber  _ '" />' ~%]
43
        [%~ action_block = action_block _ '<input type="hidden" name="op" value="edit_form" />' ~%]
44
        [%~ action_block = action_block _ '<input type="hidden" name="op" value="edit_form" />' ~%]
44
        [%~ action_block = action_block _ '<input type="hidden" name="public" value="' _ public _ '" />' ~%]
45
        [%~ action_block = action_block _ '<input type="hidden" name="public" value="' _ public _ '" />' ~%]
Lines 48-53 Link Here
48
    [%~ END ~%]
49
    [%~ END ~%]
49
    [%~ IF can_delete_shelf ~%]
50
    [%~ IF can_delete_shelf ~%]
50
        [%~ action_block = action_block _ ' <form action="shelves.pl" method="post">' ~%]
51
        [%~ action_block = action_block _ ' <form action="shelves.pl" method="post">' ~%]
52
        [%~ action_block = BLOCK ~%][%~ action_block | $raw ~%][%~ INCLUDE 'csrf-token.inc' | trim ~%][%~ END ~%]
51
        [%~ action_block = action_block _ '<input type="hidden" name="shelves" value="1" />' ~%]
53
        [%~ action_block = action_block _ '<input type="hidden" name="shelves" value="1" />' ~%]
52
        [%~ action_block = action_block _ '<input type="hidden" name="op" value="delete" />' ~%]
54
        [%~ action_block = action_block _ '<input type="hidden" name="op" value="delete" />' ~%]
53
        [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber  _ '" />' ~%]
55
        [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber  _ '" />' ~%]
Lines 70-73 Link Here
70
    [%~ SET action_block = 'None' ~%]
72
    [%~ SET action_block = 'None' ~%]
71
[%~ END ~%]
73
[%~ END ~%]
72
[%~ To.json(action_block) | $raw ~%]
74
[%~ To.json(action_block) | $raw ~%]
75
73
[%~ END ~%]
76
[%~ END ~%]
(-)a/members/setstatus.pl (-1 / +1 lines)
Lines 34-40 use Koha::Patrons; Link Here
34
34
35
my $input = CGI->new;
35
my $input = CGI->new;
36
36
37
my ( $loggedinuserid ) = checkauth($input, 0, { borrowers => 'edit_borrowers' }, 'intranet');
37
my ( $loggedinuserid, $cookie ) = checkauth($input, 0, { borrowers => 'edit_borrowers' }, 'intranet');
38
38
39
my $destination = $input->param("destination") || '';
39
my $destination = $input->param("destination") || '';
40
my $borrowernumber=$input->param('borrowernumber');
40
my $borrowernumber=$input->param('borrowernumber');
(-)a/virtualshelves/shelves.pl (-2 / +7 lines)
Lines 29-35 use C4::Koha qw( Link Here
29
    GetNormalizedUPC
29
    GetNormalizedUPC
30
);
30
);
31
use C4::Members;
31
use C4::Members;
32
use C4::Output qw( pagination_bar output_html_with_http_headers );
32
use C4::Output qw( pagination_bar output_html_with_http_headers output_and_exit_if_error );
33
use C4::XSLT qw( XSLTParse4Display );
33
use C4::XSLT qw( XSLTParse4Display );
34
34
35
use Koha::Biblios;
35
use Koha::Biblios;
Lines 63-68 if ( $op eq 'add_form' ) { Link Here
63
    # Only pass default
63
    # Only pass default
64
    $shelf = { allow_change_from_owner => 1 };
64
    $shelf = { allow_change_from_owner => 1 };
65
} elsif ( $op eq 'edit_form' ) {
65
} elsif ( $op eq 'edit_form' ) {
66
    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
66
    $shelfnumber = $query->param('shelfnumber');
67
    $shelfnumber = $query->param('shelfnumber');
67
    $shelf       = Koha::Virtualshelves->find($shelfnumber);
68
    $shelf       = Koha::Virtualshelves->find($shelfnumber);
68
69
Lines 78-83 if ( $op eq 'add_form' ) { Link Here
78
        push @messages, { type => 'alert', code => 'does_not_exist' };
79
        push @messages, { type => 'alert', code => 'does_not_exist' };
79
    }
80
    }
80
} elsif ( $op eq 'add' ) {
81
} elsif ( $op eq 'add' ) {
82
    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
81
    my $allow_changes_from = $query->param('allow_changes_from');
83
    my $allow_changes_from = $query->param('allow_changes_from');
82
    eval {
84
    eval {
83
        $shelf = Koha::Virtualshelf->new(
85
        $shelf = Koha::Virtualshelf->new(
Lines 103-108 if ( $op eq 'add_form' ) { Link Here
103
        $op = 'view';
105
        $op = 'view';
104
    }
106
    }
105
} elsif ( $op eq 'edit' ) {
107
} elsif ( $op eq 'edit' ) {
108
    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
106
    $shelfnumber = $query->param('shelfnumber');
109
    $shelfnumber = $query->param('shelfnumber');
107
    $shelf       = Koha::Virtualshelves->find($shelfnumber);
110
    $shelf       = Koha::Virtualshelves->find($shelfnumber);
108
111
Lines 133-138 if ( $op eq 'add_form' ) { Link Here
133
        push @messages, { type => 'alert', code => 'does_not_exist' };
136
        push @messages, { type => 'alert', code => 'does_not_exist' };
134
    }
137
    }
135
} elsif ( $op eq 'delete' ) {
138
} elsif ( $op eq 'delete' ) {
139
    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
136
    $shelfnumber = $query->param('shelfnumber');
140
    $shelfnumber = $query->param('shelfnumber');
137
    $shelf       = Koha::Virtualshelves->find($shelfnumber);
141
    $shelf       = Koha::Virtualshelves->find($shelfnumber);
138
    if ($shelf) {
142
    if ($shelf) {
Lines 151-156 if ( $op eq 'add_form' ) { Link Here
151
    }
155
    }
152
    $op = 'list';
156
    $op = 'list';
153
} elsif ( $op eq 'add_biblio' ) {
157
} elsif ( $op eq 'add_biblio' ) {
158
    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
154
    $shelfnumber = $query->param('shelfnumber');
159
    $shelfnumber = $query->param('shelfnumber');
155
    $shelf = Koha::Virtualshelves->find($shelfnumber);
160
    $shelf = Koha::Virtualshelves->find($shelfnumber);
156
    if ($shelf) {
161
    if ($shelf) {
Lines 207-212 if ( $op eq 'add_form' ) { Link Here
207
    }
212
    }
208
    $op = $referer;
213
    $op = $referer;
209
} elsif ( $op eq 'remove_biblios' ) {
214
} elsif ( $op eq 'remove_biblios' ) {
215
    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
210
    $shelfnumber = $query->param('shelfnumber');
216
    $shelfnumber = $query->param('shelfnumber');
211
    $shelf = Koha::Virtualshelves->find($shelfnumber);
217
    $shelf = Koha::Virtualshelves->find($shelfnumber);
212
    my @biblionumbers = $query->multi_param('biblionumber');
218
    my @biblionumbers = $query->multi_param('biblionumber');
213
- 

Return to bug 22990