Attachment 156070 Details for Bug 34478 – Bug 34478: op =~ ^cud-

[patch] Bug 34478: op =~ ^cud-

Bug-34478-op--cud-.patch (text/plain), 6.43 KB, created by Jonathan Druart on 2023-09-22 11:38:14 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2023-09-22 11:38:14 UTC

Size: 6.43 KB

patch

obsolete

>From 555a8f133579ea6f8616f0203ac18871d4210542 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Fri, 22 Sep 2023 10:55:29 +0200
>Subject: [PATCH] Bug 34478: op =~ ^cud-
>
>---
> C4/Auth.pm                                     |  6 ++++--
> admin/branches.pl                              |  4 ++--
> debian/templates/plack.psgi                    | 18 ++++++++----------
> .../prog/en/includes/csrf-token.inc            |  4 ++--
> .../prog/en/modules/admin/branches.tt          |  6 +++---
> 5 files changed, 19 insertions(+), 19 deletions(-)
>
>diff --git a/C4/Auth.pm b/C4/Auth.pm
>index 32feddbf322..8bb8eae3f3e 100644
>--- a/C4/Auth.pm
>+++ b/C4/Auth.pm
>@@ -636,7 +636,8 @@ sub get_template_and_user {
>         $cookie = $cookie_mgr->replace_in_list( $cookie, $languagecookie );
>     }
> 
>-    if ( $in->{query}->param('op-cud') ) {
>+    my $op = $in->{query}->param('op');
>+    if ( defined $op && $op =~ m{^cud-} ) {
>         C4::Output::output_and_exit( $in->{query}, $cookie, $template, 'wrong_csrf_token' )
>             unless Koha::Token->new->check_csrf(
>             {
>@@ -1338,7 +1339,8 @@ sub checkauth {
> 
>         track_login_daily( $userid );
> 
>-        if ( $query->param('op-cud') ) {
>+        my $op = $query->param('op');
>+        if ( defined $op && $op =~ m{^cud-} ) {
>             die "Cannot use GET for this request"
>                 if $request_method eq 'GET';
> 
>diff --git a/admin/branches.pl b/admin/branches.pl
>index 112ca421d35..8c4fe35f80f 100755
>--- a/admin/branches.pl
>+++ b/admin/branches.pl
>@@ -58,7 +58,7 @@ if ( $op eq 'add_form' ) {
>     $template->param(
>         library      => $library,
>     );
>-} elsif ( $op eq 'add_validate' ) {
>+} elsif ( $op eq 'cud-add_validate' ) {
>     my @fields = qw(
>       branchname
>       branchaddress1
>@@ -189,7 +189,7 @@ if ( $op eq 'add_form' ) {
>             patrons_count => $patrons_count,
>         );
>     }
>-} elsif ( $op eq 'delete_confirmed' ) {
>+} elsif ( $op eq 'cud-delete_confirmed' ) {
>     my $library = Koha::Libraries->find($branchcode);
> 
>     my $deleted = eval { $library->delete; };
>diff --git a/debian/templates/plack.psgi b/debian/templates/plack.psgi
>index 577118148c9..eadb17204ff 100644
>--- a/debian/templates/plack.psgi
>+++ b/debian/templates/plack.psgi
>@@ -48,16 +48,14 @@ use CGI qw(-utf8 ); # we will loose -utf8 under plack, otherwise
>         Koha::Caches->flush_L1_caches();
>         Koha::Cache::Memory::Lite->flush();
> 
>-        $original_op_cud = $q->param('op-cud');
>-        $request_method  = $q->request_method // q{};
>-        if ( $request_method eq 'GET' && defined $original_op_cud ) {
>-            warn "Programming error - op-cud must not be passed with GET";
>-            $q->param( 'op-cud', undef );
>-        } elsif ( $request_method ne 'GET' && defined $q->param('op') ) {
>-            warn "Programming error - op can only be passed with GET";
>-            $q->param( 'op', undef );
>-        } else {
>-            $q->param( 'op', $original_op_cud );
>+        my $original_op    = $q->param('op');
>+        my $request_method = $q->request_method // q{};
>+        if ( $request_method eq 'GET' && defined $original_op && $original_op =~ m{^cud-} ) {
>+            warn "Programming error - op '$original_op' must not start with 'cud-' with GET";
>+            $q->param( 'op', '' );
>+        } elsif ( $request_method ne 'GET' && defined $q->param('op') && $original_op !~ m{^cud-} ) {
>+            warn "Programming error - op '$original_op' must start with 'cud-' for $request_method";
>+            $q->param( 'op', '' );
>         }
> 
>         return $q;
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc
>index bfc221faf40..2ec6a07fac6 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc
>@@ -1,3 +1,3 @@
>-[%- USE Koha %]
>-[%- USE raw %]
>+[%- USE Koha -%]
>+[%- USE raw -%]
> <input type="hidden" name="csrf_token" value="[% Koha.GenerateCSRF | $raw %]" />
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt
>index 8fc95cc3ee3..51760e6b910 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt
>@@ -127,7 +127,7 @@
>     <form action="/cgi-bin/koha/admin/branches.pl" id="Aform" name="Aform" class="validated" method="post">
>         [% INCLUDE 'csrf-token.inc' %]
>         <fieldset class="rows">
>-            <input type="hidden" name="op-cud" value="add_validate" />
>+            <input type="hidden" name="op" value="cud-add_validate" />
>             [% IF library %]
>                 <input type="hidden" name="is_a_modif" value="1" />
>             [% END %]
>@@ -302,7 +302,7 @@
>         <form action="/cgi-bin/koha/admin/branches.pl" method="post">
>             [% INCLUDE 'csrf-token.inc' %]
>             <h1>Are you sure you want to delete [% library.branchname | html %] ([% library.branchcode | html %])?</h1>
>-            <input type="hidden" name="op-cud" value="delete_confirmed" />
>+            <input type="hidden" name="op" value="cud-delete_confirmed" />
>             <input type="hidden" name="branchcode" value="[% library.branchcode | html %]" />
>             <input type="hidden" name="branchname" value="[% library.branchname | html %]">
>             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
>@@ -605,7 +605,7 @@
>                         "data": function( row, type, val, meta ) {
> 
>                             var result = '<a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/branches.pl?op=add_form&amp;branchcode='+encodeURIComponent(row.library_id)+'" role="button"><i class="fa-solid fa-pencil" aria-hidden="true"></i> '+_("Edit")+'</a>';
>-                            result += '<form action="/cgi-bin/koha/admin/branches.pl" method="post">';
>+                            result += '<form action="/cgi-bin/koha/admin/branches.pl" method="get">';
>                             result += '<input type="hidden" name="branchcode" value="'+row.library_id.escapeHtml()+'" />'+"\n";
>                             result += '<input type="hidden" name="op" value="delete_confirm" />';
>                             result += '<button type="submit" id="delete_library_'+row.library_id.escapeHtml()+'" class="btn btn-default btn-xs" role="button"><i class="fa fa-trash-can" aria-hidden="true"></i> '+_("Delete")+'</button></form>';
>-- 
>2.25.1

Actions: View | Diff | Splinter Review

Attachments on bug 34478: 154241 | 154242 | 154243 | 154244 | 154245 | 154246 | 154247 | 154248 | 154249 | 154250 | 154251 | 154252 | 154253 | 154254 | 155971 | 155972 | 155973 | 155974 | 155975 | 155976 | 155977 | 155978 | 155979 | 155980 | 155981 | 155982 | 155983 | 155984 | 155985 | 155986 | 155987 | 155988 | 155989 | 155990 | 156070 | 156071 | 156072 | 156073 | 156074 | 162114 | 162165 | 162630