Bugzilla – Attachment 162837 Details for
Bug 36193
CSRF - Code review missed
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36193: cud- treatment for tools/stockrotation.pl
Bug-36193-cud--treatment-for-toolsstockrotationpl.patch (text/plain), 14.05 KB, created by
Tomás Cohen Arazi (tcohen)
on 2024-03-06 15:45:24 UTC
(
hide
)
Description:
Bug 36193: cud- treatment for tools/stockrotation.pl
Filename:
MIME Type:
Creator:
Tomás Cohen Arazi (tcohen)
Created:
2024-03-06 15:45:24 UTC
Size:
14.05 KB
patch
obsolete
>From a4ab40f532b41b3309ca7807efa99122ca7cbc3e Mon Sep 17 00:00:00 2001 >From: Tomas Cohen Arazi <tomascohen@theke.io> >Date: Wed, 6 Mar 2024 12:44:18 -0300 >Subject: [PATCH] Bug 36193: cud- treatment for tools/stockrotation.pl > >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >--- > .../prog/en/modules/tools/stockrotation.tt | 81 +++++++++++++------ > tools/stockrotation.pl | 12 +-- > 2 files changed, 62 insertions(+), 31 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stockrotation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stockrotation.tt >index a231a2cbc76..a1fa55af07a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stockrotation.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stockrotation.tt >@@ -147,14 +147,18 @@ > [% END %] > </ul> > </div> >- <a class="btn btn-default btn-xs" href="?op=toggle_rota&rota_id=[% rota.rota_id | uri %]"> >- <i class="fa fa-power-off"></i> >+ <form id="toggle_rota_[% rota.rota_id | html %]" method="post" action="/cgi-bin/koha/tools/stockrotation.pl"> >+ [% INCLUDE 'csrf-token.inc' %] >+ <input type="hidden" name="op" value="cud-toggle_rota" /> >+ <input type="hidden" name="rota_id" value="[% rota.rota_id | html %]" /> >+ <button class="btn btn-default btn-xs" type="submit"><i class="fa fa-power-off"></i> > [% IF !rota.active %] > Activate > [% ELSE %] > Deactivate > [% END %] >- </a> >+ </button> >+ </form> > <a class="btn btn-default btn-xs" href="?op=confirm_delete_rota&rota_id=[% rota.rota_id | uri %]"> > <i class="fa fa-trash"></i> > Delete >@@ -380,8 +384,15 @@ > <div class="dialog alert"> > <h1>Are you sure you wish to remove this item from its rota</h1> > <p> >- <a class="btn btn-default btn-xs approve" href="?op=remove_item_from_stage&item_id=[% item_id | uri %]&stage_id=[% stage_id | uri %]&rota_id=[% rota_id | uri %]"><i class="fa fa-fw fa-check"></i>Yes</a> >- <a class="btn btn-default btn-xs deny" href="?op=manage_items&rota_id=[% rota_id | uri %]"><i class="fa fa-fw fa-times"></i>No</a> >+ <form id="remove_item_from_stage_[% item_id | html %]_[% rota.rota_id | html %]" method="post" action="/cgi-bin/koha/tools/stockrotation.pl"> >+ [% INCLUDE 'csrf-token.inc' %] >+ <input type="hidden" name="op" value="cud-remove_item_from_stage" /> >+ <input type="hidden" name="item_id" value="[% item_id | html %]" /> >+ <input type="hidden" name="rota_id" value="[% rota_id | html %]" /> >+ <input type="hidden" name="stage_id" value="[% stage_id | html %]" /> >+ <button class="btn btn-default btn-xs approve" type="submit"><i class="fa fa-fw fa-check"></i> Yes</button> >+ </form> >+ <a class="btn btn-default btn-xs deny" href="?op=manage_items&rota_id=[% rota_id | uri %]"><i class="fa fa-fw fa-times"></i> No</a> > </p> > </div> > [% ELSIF (op == 'confirm_delete_rota') %] >@@ -396,8 +407,13 @@ > [% END %] > [% END %] > <p> >- <a class="btn btn-default btn-xs approve" href="?op=delete_rota&rota_id=[% rota_id | uri %]"><i class="fa fa-fw fa-check"></i>Yes</a> >- <a class="btn btn-default btn-xs deny" href="/cgi-bin/koha/tools/stockrotation.pl"><i class="fa fa-fw fa-times"></i>No</a> >+ <form id="delete_rota_[% rota.rota_id | html %]" method="post" action="/cgi-bin/koha/tools/stockrotation.pl"> >+ [% INCLUDE 'csrf-token.inc' %] >+ <input type="hidden" name="op" value="cud-delete_rota" /> >+ <input type="hidden" name="rota_id" value="[% rota.rota_id | html %]" /> >+ <button class="btn btn-default btn-xs approve" type="submit"><i class="fa fa-fw fa-check"></i> Yes</button> >+ </form> >+ <a class="btn btn-default btn-xs deny" href="/cgi-bin/koha/tools/stockrotation.pl"><i class="fa fa-fw fa-times"></i> No</a> > </p> > </div> > [% ELSIF (op == 'confirm_delete_stage') %] >@@ -413,8 +429,13 @@ > </ul> > [% END %] > <p> >- <a class="btn btn-default btn-xs approve" href="?op=delete_stage&stage_id=[% stage.stage_id | uri %]"><i class="fa fa-fw fa-check"></i>Yes</a> >- <a class="btn btn-default btn-xs deny" href="?op=manage_stages&rota_id=[% stage.rota.rota_id | uri %]"><i class="fa fa-fw fa-times"></i>No</a> >+ <form id="delete_stage_[% stage.stage_id | html %]" method="post" action="/cgi-bin/koha/tools/stockrotation.pl"> >+ [% INCLUDE 'csrf-token.inc' %] >+ <input type="hidden" name="op" value="cud-delete_stage" /> >+ <input type="hidden" name="stage_id" value="[% stage.stage_id | html %]" /> >+ <button class="btn btn-default btn-xs approve" type="submit"><i class="fa fa-fw fa-check"></i> Yes</button> >+ </form> >+ <a class="btn btn-default btn-xs deny" href="?op=manage_stages&rota_id=[% stage.rota.rota_id | uri %]"><i class="fa fa-fw fa-times"></i> No</a> > </p> > </div> > [% ELSIF (op == 'manage_items') %] >@@ -517,26 +538,36 @@ > [% in_transit = sritem.item.get_transfer %] > [% IF stages.size < 2 %] > <a class="btn btn-default btn-xs" title="Rota has a single stage, advancing will have no effect" disabled> >- [% ELSIF !in_transit %] >- <a class="btn btn-default btn-xs" href="?op=move_to_next_stage&rota_id=[% rota.id | uri %]&item_id=[% sritem.id | uri %]&stage_id=[% sritem.stage.stage_id | uri %]"> > [% ELSE %] >- <a class="btn btn-default btn-xs" href="?op=move_to_next_stage&rota_id=[% rota.id | uri %]&item_id=[% sritem.id | uri %]&stage_id=[% sritem.stage.stage_id | uri %]" title="Item is in transit, it will be directed to new stage when checked in"> >+ <form id="move_to_next_stage_[% sritem.id | html %]_[% rota.id | html %]" method="post" action="/cgi-bin/koha/tools/stockrotation.pl"> >+ [% INCLUDE 'csrf-token.inc' %] >+ <input type="hidden" name="op" value="cud-move_to_next_stage" /> >+ <input type="hidden" name="item_id" value="[% sritem.id | html %]" /> >+ <input type="hidden" name="rota_id" value="[% rota.id | html %]" /> >+ <input type="hidden" name="stage_id" value="[% sritem.stage.stage_id | html %]" /> >+ [% IF !in_transit %] >+ <button class="btn btn-default btn-xs" type="submit"><i class="fa fa-arrow-right"></i> Move to next stage</button> >+ [% ELSE %] >+ <button class="btn btn-default btn-xs" type="submit" title="Item is in transit, it will be directed to new stage when checked in"><i class="fa fa-arrow-right"></i> Move to next stage</button> >+ [% END %] >+ </form> > [% END %] >- <i class="fa fa-arrow-right"></i> >- Move to next stage >- </a> >+ > [% IF !in_transit %] >- <a class="btn btn-default btn-xs" href="?op=toggle_in_demand&stage_id=[% sritem.stage.stage_id | uri %]&item_id=[% sritem.id | uri %]&rota_id=[% rota.id | uri %]"> >- [% ELSE %] >- <a class="btn btn-default btn-xs" disabled> >+ <form id="toggle_in_demand_[% sritem.id | html %]_[% rota.id | html %]" method="post" action="/cgi-bin/koha/tools/stockrotation.pl"> >+ [% INCLUDE 'csrf-token.inc' %] >+ <input type="hidden" name="op" value="cud-toggle_in_demand" /> >+ <input type="hidden" name="item_id" value="[% sritem.id | html %]" /> >+ <input type="hidden" name="rota_id" value="[% rota.id | html %]" /> >+ <input type="hidden" name="stage_id" value="[% sritem.stage.stage_id | html %]" /> >+ [% IF sritem.indemand %] >+ <button class="btn btn-default btn-xs" type="submit"><i class="fa fa-fire"></i> Remove "In demand"</button> >+ [% ELSE %] >+ <button class="btn btn-default btn-xs" type="submit"><i class="fa fa-fire"></i> Add "In demand"</button> >+ [% END %] >+ </form> > [% END %] >- <i class="fa fa-fire"></i> >- [% IF sritem.indemand %] >- <span>Remove "In demand"</span> >- [% ELSE %] >- <span>Add "In demand"</span> >- [% END %] >- </a> >+ > [% IF !in_transit %] > <a class="btn btn-default btn-xs" href="?op=confirm_remove_from_rota&stage_id=[% sritem.stage.stage_id | uri %]&item_id=[% sritem.id | uri %]&rota_id=[% rota.id | uri %]"> > [% ELSE %] >diff --git a/tools/stockrotation.pl b/tools/stockrotation.pl >index 992cf71086b..b818a38f7d1 100755 >--- a/tools/stockrotation.pl >+++ b/tools/stockrotation.pl >@@ -107,7 +107,7 @@ if (!defined $op) { > op => $op > ); > >-} elsif ($op eq 'toggle_rota') { >+} elsif ($op eq 'cud-toggle_rota') { > > # Find and update the active status of the rota > my $rota = Koha::StockRotationRotas->find($params{rota_id}); >@@ -223,7 +223,7 @@ if (!defined $op) { > op => $op > ); > >-} elsif ($op eq 'delete_rota') { >+} elsif ($op eq 'cud-delete_rota') { > > # Get the rota we're deleting > my $rota = Koha::StockRotationRotas->find($params{rota_id}); >@@ -243,7 +243,7 @@ if (!defined $op) { > stage => $stage > ); > >-} elsif ($op eq 'delete_stage') { >+} elsif ($op eq 'cud-delete_stage') { > > # Get the stage we're deleting > my $stage = Koha::StockRotationStages->find($params{stage_id}); >@@ -315,14 +315,14 @@ if (!defined $op) { > op => $op > ); > >-} elsif ($op eq 'move_to_next_stage') { >+} elsif ($op eq 'cud-move_to_next_stage') { > > move_to_next_stage($params{item_id}, $params{stage_id}); > > # Return to the items list > print $input->redirect("?op=manage_items&rota_id=" . $params{rota_id}); > >-} elsif ($op eq 'toggle_in_demand') { >+} elsif ($op eq 'cud-toggle_in_demand') { > > # Toggle the item's in_demand > toggle_indemand($params{item_id}, $params{stage_id}); >@@ -330,7 +330,7 @@ if (!defined $op) { > # Return to the items list > print $input->redirect("?op=manage_items&rota_id=".$params{rota_id}); > >-} elsif ($op eq 'remove_item_from_stage') { >+} elsif ($op eq 'cud-remove_item_from_stage') { > > # Remove the item from the stage > remove_from_stage($params{item_id}, $params{stage_id}); >-- >2.44.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36193
:
162684
|
162733
|
162734
|
162749
|
162750
|
162751
|
162752
|
162755
|
162769
|
162770
|
162771
|
162772
|
162773
|
162774
|
162775
|
162776
|
162777
|
162784
|
162830
|
162831
| 162837