Bugzilla – Attachment 162734 Details for
Bug 36193
CSRF - Code review missed
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36193: cud- treatment for Acq order receipt cancelling
Bug-36193-cud--treatment-for-Acq-order-receipt-can.patch (text/plain), 2.68 KB, created by
Tomás Cohen Arazi (tcohen)
on 2024-03-04 22:38:39 UTC
(
hide
)
Description:
Bug 36193: cud- treatment for Acq order receipt cancelling
Filename:
MIME Type:
Creator:
Tomás Cohen Arazi (tcohen)
Created:
2024-03-04 22:38:39 UTC
Size:
2.68 KB
patch
obsolete
>From e62c5d97680b782f0a04687e41751aa0c7654d5b Mon Sep 17 00:00:00 2001 >From: Tomas Cohen Arazi <tomascohen@theke.io> >Date: Mon, 4 Mar 2024 19:37:34 -0300 >Subject: [PATCH] Bug 36193: cud- treatment for Acq order receipt cancelling > >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >--- > acqui/parcel.pl | 2 +- > .../intranet-tmpl/prog/en/modules/acqui/parcel.tt | 13 ++++++++++++- > 2 files changed, 13 insertions(+), 2 deletions(-) > >diff --git a/acqui/parcel.pl b/acqui/parcel.pl >index 06172690f68..7fd16c76d23 100755 >--- a/acqui/parcel.pl >+++ b/acqui/parcel.pl >@@ -82,7 +82,7 @@ my $op = $input->param('op') // ''; > > # process cancellation first so that list of > # orders to display is calculated after >-if ($op eq 'cancelreceipt') { >+if ($op eq 'cud-cancelreceipt') { > my $ordernumber = $input->param('ordernumber'); > my $parent_ordernumber = CancelReceipt($ordernumber); > unless($parent_ordernumber) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt >index dcb9379874f..74badf6d47e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt >@@ -294,7 +294,13 @@ > Can't cancel receipt > </span> > [% ELSE %] >- <a href="/cgi-bin/koha/acqui/parcel.pl?invoiceid=[% invoiceid | uri %]&op=cancelreceipt&ordernumber=[% order.ordernumber | uri %]">Cancel receipt</a> >+ <form id="cancel_receipt_[% order.ordernumber | html %]" method="post" action="/cgi-bin/koha/acqui/parcel.pl"> >+ [% INCLUDE 'csrf-token.inc' %] >+ <input type="hidden" name="op" value="cud-cancelreceipt" /> >+ <input type="hidden" name="ordernumber" value="[% order.ordernumber | html %]" /> >+ <input type="hidden" name="invoiceid" value="[% invoiceid | html %]" /> >+ </form> >+ <a href="#" class="cancel_receipt" data-ordernumber="[% order.ordernumber | html %]">Cancel receipt</a> > [% END %] > </td> > </tr> >@@ -359,6 +365,11 @@ > > $(document).ready(function(){ > >+ $(".cancel_receipt").on( 'click', function(e){ >+ e.preventDefault(); >+ $('#cancel_receipt_' + $(this).data('ordernumber')).submit(); >+ }); >+ > if ( $("#receivedt").length ) { > var receivedt = $("#receivedt").dataTable($.extend(true, {}, dataTablesDefaults, { > "stateSave": true, >-- >2.44.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36193
:
162684
|
162733
|
162734
|
162749
|
162750
|
162751
|
162752
|
162755
|
162769
|
162770
|
162771
|
162772
|
162773
|
162774
|
162775
|
162776
|
162777
|
162784
|
162830
|
162831
|
162837