View | Details | Raw Unified | Return to bug 34478
Collapse All | Expand All

(-)a/C4/Auth.pm (-2 / +4 lines)
Lines 636-642 sub get_template_and_user { Link Here
636
        $cookie = $cookie_mgr->replace_in_list( $cookie, $languagecookie );
636
        $cookie = $cookie_mgr->replace_in_list( $cookie, $languagecookie );
637
    }
637
    }
638
638
639
    if ( $in->{query}->param('op-cud') ) {
639
    my $op = $in->{query}->param('op');
640
    if ( defined $op && $op =~ m{^cud-} ) {
640
        C4::Output::output_and_exit( $in->{query}, $cookie, $template, 'wrong_csrf_token' )
641
        C4::Output::output_and_exit( $in->{query}, $cookie, $template, 'wrong_csrf_token' )
641
            unless Koha::Token->new->check_csrf(
642
            unless Koha::Token->new->check_csrf(
642
            {
643
            {
Lines 1338-1344 sub checkauth { Link Here
1338
1339
1339
        track_login_daily( $userid );
1340
        track_login_daily( $userid );
1340
1341
1341
        if ( $query->param('op-cud') ) {
1342
        my $op = $query->param('op');
1343
        if ( defined $op && $op =~ m{^cud-} ) {
1342
            die "Cannot use GET for this request"
1344
            die "Cannot use GET for this request"
1343
                if $request_method eq 'GET';
1345
                if $request_method eq 'GET';
1344
1346
(-)a/admin/branches.pl (-2 / +2 lines)
Lines 58-64 if ( $op eq 'add_form' ) { Link Here
58
    $template->param(
58
    $template->param(
59
        library      => $library,
59
        library      => $library,
60
    );
60
    );
61
} elsif ( $op eq 'add_validate' ) {
61
} elsif ( $op eq 'cud-add_validate' ) {
62
    my @fields = qw(
62
    my @fields = qw(
63
      branchname
63
      branchname
64
      branchaddress1
64
      branchaddress1
Lines 189-195 if ( $op eq 'add_form' ) { Link Here
189
            patrons_count => $patrons_count,
189
            patrons_count => $patrons_count,
190
        );
190
        );
191
    }
191
    }
192
} elsif ( $op eq 'delete_confirmed' ) {
192
} elsif ( $op eq 'cud-delete_confirmed' ) {
193
    my $library = Koha::Libraries->find($branchcode);
193
    my $library = Koha::Libraries->find($branchcode);
194
194
195
    my $deleted = eval { $library->delete; };
195
    my $deleted = eval { $library->delete; };
(-)a/debian/templates/plack.psgi (-10 / +8 lines)
Lines 48-63 use CGI qw(-utf8 ); # we will loose -utf8 under plack, otherwise Link Here
48
        Koha::Caches->flush_L1_caches();
48
        Koha::Caches->flush_L1_caches();
49
        Koha::Cache::Memory::Lite->flush();
49
        Koha::Cache::Memory::Lite->flush();
50
50
51
        $original_op_cud = $q->param('op-cud');
51
        my $original_op    = $q->param('op');
52
        $request_method  = $q->request_method // q{};
52
        my $request_method = $q->request_method // q{};
53
        if ( $request_method eq 'GET' && defined $original_op_cud ) {
53
        if ( $request_method eq 'GET' && defined $original_op && $original_op =~ m{^cud-} ) {
54
            warn "Programming error - op-cud must not be passed with GET";
54
            warn "Programming error - op '$original_op' must not start with 'cud-' with GET";
55
            $q->param( 'op-cud', undef );
55
            $q->param( 'op', '' );
56
        } elsif ( $request_method ne 'GET' && defined $q->param('op') ) {
56
        } elsif ( $request_method ne 'GET' && defined $q->param('op') && $original_op !~ m{^cud-} ) {
57
            warn "Programming error - op can only be passed with GET";
57
            warn "Programming error - op '$original_op' must start with 'cud-' for $request_method";
58
            $q->param( 'op', undef );
58
            $q->param( 'op', '' );
59
        } else {
60
            $q->param( 'op', $original_op_cud );
61
        }
59
        }
62
60
63
        return $q;
61
        return $q;
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc (-2 / +2 lines)
Lines 1-3 Link Here
1
[%- USE Koha %]
1
[%- USE Koha -%]
2
[%- USE raw %]
2
[%- USE raw -%]
3
<input type="hidden" name="csrf_token" value="[% Koha.GenerateCSRF | $raw %]" />
3
<input type="hidden" name="csrf_token" value="[% Koha.GenerateCSRF | $raw %]" />
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt (-4 / +3 lines)
Lines 127-133 Link Here
127
    <form action="/cgi-bin/koha/admin/branches.pl" id="Aform" name="Aform" class="validated" method="post">
127
    <form action="/cgi-bin/koha/admin/branches.pl" id="Aform" name="Aform" class="validated" method="post">
128
        [% INCLUDE 'csrf-token.inc' %]
128
        [% INCLUDE 'csrf-token.inc' %]
129
        <fieldset class="rows">
129
        <fieldset class="rows">
130
            <input type="hidden" name="op-cud" value="add_validate" />
130
            <input type="hidden" name="op" value="cud-add_validate" />
131
            [% IF library %]
131
            [% IF library %]
132
                <input type="hidden" name="is_a_modif" value="1" />
132
                <input type="hidden" name="is_a_modif" value="1" />
133
            [% END %]
133
            [% END %]
Lines 302-308 Link Here
302
        <form action="/cgi-bin/koha/admin/branches.pl" method="post">
302
        <form action="/cgi-bin/koha/admin/branches.pl" method="post">
303
            [% INCLUDE 'csrf-token.inc' %]
303
            [% INCLUDE 'csrf-token.inc' %]
304
            <h1>Are you sure you want to delete [% library.branchname | html %] ([% library.branchcode | html %])?</h1>
304
            <h1>Are you sure you want to delete [% library.branchname | html %] ([% library.branchcode | html %])?</h1>
305
            <input type="hidden" name="op-cud" value="delete_confirmed" />
305
            <input type="hidden" name="op" value="cud-delete_confirmed" />
306
            <input type="hidden" name="branchcode" value="[% library.branchcode | html %]" />
306
            <input type="hidden" name="branchcode" value="[% library.branchcode | html %]" />
307
            <input type="hidden" name="branchname" value="[% library.branchname | html %]">
307
            <input type="hidden" name="branchname" value="[% library.branchname | html %]">
308
            <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
308
            <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
Lines 605-611 Link Here
605
                        "data": function( row, type, val, meta ) {
605
                        "data": function( row, type, val, meta ) {
606
606
607
                            var result = '<a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/branches.pl?op=add_form&amp;branchcode='+encodeURIComponent(row.library_id)+'" role="button"><i class="fa-solid fa-pencil" aria-hidden="true"></i> '+_("Edit")+'</a>';
607
                            var result = '<a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/branches.pl?op=add_form&amp;branchcode='+encodeURIComponent(row.library_id)+'" role="button"><i class="fa-solid fa-pencil" aria-hidden="true"></i> '+_("Edit")+'</a>';
608
                            result += '<form action="/cgi-bin/koha/admin/branches.pl" method="post">';
608
                            result += '<form action="/cgi-bin/koha/admin/branches.pl" method="get">';
609
                            result += '<input type="hidden" name="branchcode" value="'+row.library_id.escapeHtml()+'" />'+"\n";
609
                            result += '<input type="hidden" name="branchcode" value="'+row.library_id.escapeHtml()+'" />'+"\n";
610
                            result += '<input type="hidden" name="op" value="delete_confirm" />';
610
                            result += '<input type="hidden" name="op" value="delete_confirm" />';
611
                            result += '<button type="submit" id="delete_library_'+row.library_id.escapeHtml()+'" class="btn btn-default btn-xs" role="button"><i class="fa fa-trash-can" aria-hidden="true"></i> '+_("Delete")+'</button></form>';
611
                            result += '<button type="submit" id="delete_library_'+row.library_id.escapeHtml()+'" class="btn btn-default btn-xs" role="button"><i class="fa fa-trash-can" aria-hidden="true"></i> '+_("Delete")+'</button></form>';
612
- 

Return to bug 34478