Bugzilla – Attachment 155972 Details for
Bug 34478
Full CSRF protection
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 34478: Replace get with post when needed
Bug-34478-Replace-get-with-post-when-needed.patch (text/plain), 12.95 KB, created by
Jonathan Druart
on 2023-09-21 10:04:37 UTC
(
hide
)
Description:
Bug 34478: Replace get with post when needed
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2023-09-21 10:04:37 UTC
Size:
12.95 KB
patch
obsolete
>From 76b40106f991aa04a927c680d5da0dc7a75602ec Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Fri, 4 Aug 2023 10:32:17 +0200 >Subject: [PATCH] Bug 34478: Replace get with post when needed > >This is what has been marked as done in "csrf_get.txt" >--- > .../prog/en/modules/patroncards/edit-layout.tt | 2 +- > .../prog/en/modules/patroncards/edit-profile.tt | 2 +- > .../prog/en/modules/patroncards/edit-template.tt | 2 +- > koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt | 2 +- > koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt | 2 +- > koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt | 2 +- > .../bootstrap/en/includes/opac-detail-sidebar.inc | 2 +- > .../bootstrap/en/modules/opac-authorities-home.tt | 2 +- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt | 2 +- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt | 8 ++++---- > 10 files changed, 13 insertions(+), 13 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt >index 5ab532b15eb..cbb46554976 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt >@@ -43,7 +43,7 @@ > </h1> > > <!-- NOTE: The order of the elements on this form is crictical to correct processing. You've been warned... --> >- <form name="input" action="/cgi-bin/koha/patroncards/edit-layout.pl" method="get"> >+ <form name="input" action="/cgi-bin/koha/patroncards/edit-layout.pl" method="post"> > <div class="row"> > <div class="col-sm-6"> > <fieldset class="rows"> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt >index 0d96f487459..ade2605ee6c 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt >@@ -46,7 +46,7 @@ > [% END%] > [% IF (profile_id) %] ([% profile_id | html %])[% END %] > </h1> >- <form name="input" action="/cgi-bin/koha/patroncards/edit-profile.pl" method="get"> >+ <form name="input" action="/cgi-bin/koha/patroncards/edit-profile.pl" method="post"> > <fieldset class="rows"><legend>Profile settings</legend> > <ol> > <li> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt >index 8accfe9daee..46a1ee8da6d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt >@@ -46,7 +46,7 @@ > [% END %] > [% IF (template_id) %] ([% template_id | html %])[% END %] > </h1> >- <form name="input" action="/cgi-bin/koha/patroncards/edit-template.pl" method="get"> >+ <form name="input" action="/cgi-bin/koha/patroncards/edit-template.pl" method="post"> > <div class="row"> > <div class="col-sm-6"> > <fieldset class="rows"> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt >index 0b97e033037..3cb0116eab2 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt >@@ -41,7 +41,7 @@ > You must have at least one cash register associated with the library before you can record payments. > </p> > [% IF ( CAN_user_parameters_manage_cash_registers ) %] >- <form action="/cgi-bin/koha/admin/cash_registers.pl" method="get"> >+ <form action="/cgi-bin/koha/admin/cash_registers.pl" method="post"> > <input type="hidden" name="op" value="add_form" /> > <button class="new" type="submit"><i class="fa fa-plus"></i> Create a new cash register</button> > </form> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt >index bb00da9cc2c..046d6d26803 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt >@@ -39,7 +39,7 @@ > You must have at least one cash register associated with the library before you can record payments. > </p> > [% IF ( CAN_user_parameters_manage_cash_registers ) %] >- <form action="/cgi-bin/koha/admin/cash_registers.pl" method="get"> >+ <form action="/cgi-bin/koha/admin/cash_registers.pl" method="post"> > <input type="hidden" name="op" value="add_form" /> > <button class="new" type="submit"><i class="fa fa-plus"></i> Create a new cash register</button> > </form> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt >index 61a053e9875..3d4025814c9 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt >@@ -36,7 +36,7 @@ > You must have at least one cash register associated with the library before you can record payments. > </p> > [% IF ( CAN_user_parameters_manage_cash_registers ) %] >- <form action="/cgi-bin/koha/admin/cash_registers.pl" method="get"> >+ <form action="/cgi-bin/koha/admin/cash_registers.pl" method="post"> > <input type="hidden" name="op" value="add_form" /> > <button class="new" type="submit"><i class="fa fa-plus"></i> Create a new cash register</button> > </form> >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc >index f1d4e60bdd7..a91aa475695 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc >@@ -118,7 +118,7 @@ > <h3 class="modal-title" id="exportModalLabel">Exporting to Dublin Core...</h3> > <button type="button" class="closebtn" data-dismiss="modal" aria-hidden="true">×</button> > </div> >- <form method="get" action="/cgi-bin/koha/opac-export.pl"> >+ <form method="post" action="/cgi-bin/koha/opac-export.pl"> > <div class="modal-body"> > <fieldset id="dc_fieldset"> > <input id="input-simple" type="radio" name="format" value="rdfdc"> >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt >index 6214b414684..bc220619059 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt >@@ -35,7 +35,7 @@ > <div class="col order-first order-md-first order-lg-2"> > [% END %] > <div id="userauthhome" class="maincontent"> >- <form name="f" action="/cgi-bin/koha/opac-authorities-home.pl" method="get"> >+ <form name="f" action="/cgi-bin/koha/opac-authorities-home.pl" method="post"> > <input type="hidden" name="op" value="do_search" /> > <input type="hidden" name="type" value="opac" /> > <fieldset class="rows"> >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt >index f2804af2570..1be130282ab 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt >@@ -65,7 +65,7 @@ > [% IF logged_in_user %] > <div class="dialog"> > >- <form id="recallform" action="/cgi-bin/koha/opac-recall.pl" method="get"> >+ <form id="recallform" action="/cgi-bin/koha/opac-recall.pl" method="post"> > <fieldset class="rows" id="options"> > <legend>Place a recall on <b>[% biblio.title | html %]</b> ([% biblio.author | html %])?</legend> > <ul> >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt >index 6e352839c46..823f907329a 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt >@@ -248,7 +248,7 @@ > > [% IF can_manage_shelf %] > <span class="sep">|</span> >- <form method="get" action="/cgi-bin/koha/opac-shelves.pl" class="d-inline"> >+ <form method="post" action="/cgi-bin/koha/opac-shelves.pl" class="d-inline"> > <input type="hidden" name="op" value="edit_form" /> > <input type="hidden" name="referer" value="view" /> > <input type='hidden' name='public' value='[% shelf.public | html %]' /> >@@ -546,7 +546,7 @@ > <a class="btn btn-link newshelf" href="/cgi-bin/koha/opac-shelves.pl?op=add_form"><i class="fa fa-fw fa-plus" aria-hidden="true"></i> New list</a> > [% IF can_manage_shelf %] > <span class="sep">|</span> >- <form method="get" action="/cgi-bin/koha/opac-shelves.pl" class="d-inline"> >+ <form method="post" action="/cgi-bin/koha/opac-shelves.pl" class="d-inline"> > <input type="hidden" name="op" value="edit_form" /> > <input type="hidden" name="referer" value="view" /> > <input type="hidden" name="public" value="[% shelf.public | html %]" /> >@@ -763,7 +763,7 @@ > <td>[% s.lastmodified | $KohaDates %]</td> > <td> > [% IF s.can_be_managed( loggedinusernumber ) %] >- <form action="/cgi-bin/koha/opac-shelves.pl" method="get" class="d-inline"> >+ <form action="/cgi-bin/koha/opac-shelves.pl" method="post" class="d-inline"> > <input type="hidden" name="shelfnumber" value="[% s.shelfnumber | html %]" /> > <input type="hidden" name="public" value="[% s.public | html %]" /> > <input type="hidden" name="op" value="edit_form" /> >@@ -778,7 +778,7 @@ > <a href="/cgi-bin/koha/opac-shareshelf.pl?op=invite&shelfnumber=[% s.shelfnumber | uri %]" class="sharelist btn btn-link"><i class="fa fa-share" aria-hidden="true"></i> Share</a> > [% END %] > [% IF s.is_shared AND s.can_be_managed( loggedinusernumber ) %] >- <form action="/cgi-bin/koha/opac-shelves.pl" method="get" class="d-inline"> >+ <form action="/cgi-bin/koha/opac-shelves.pl" method="post" class="d-inline"> > <input type="hidden" name="shelfnumber" value="[% s.shelfnumber | html %]" /> > <input type="hidden" name="public" value="0" /> > <input type="hidden" name="op" value="transfer" /> >-- >2.25.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 34478
:
154241
|
154242
|
154243
|
154244
|
154245
|
154246
|
154247
|
154248
|
154249
|
154250
|
154251
|
154252
|
154253
|
154254
|
155971
|
155972
|
155973
|
155974
|
155975
|
155976
|
155977
|
155978
|
155979
|
155980
|
155981
|
155982
|
155983
|
155984
|
155985
|
155986
|
155987
|
155988
|
155989
|
155990
|
156070
|
156071
|
156072
|
156073
|
156074
|
162114
|
162165
|
162630