Attachment 164061 Details for Bug 36135 – Bug 36135: (follow-up) Adjust for CSRF

[patch] Bug 36135: (follow-up) Adjust for CSRF

Bug-36135-follow-up-Adjust-for-CSRF.patch (text/plain), 4.13 KB, created by Lucas Gass (lukeg) on 2024-03-28 14:13:02 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Lucas Gass (lukeg)

Created: 2024-03-28 14:13:02 UTC

Size: 4.13 KB

patch

obsolete

>From a360275264edbd06545910e18802f27b816c47d2 Mon Sep 17 00:00:00 2001
>From: Nick Clemens <nick@bywatersolutions.com>
>Date: Wed, 20 Mar 2024 14:14:31 +0000
>Subject: [PATCH] Bug 36135: (follow-up) Adjust for CSRF
>
>Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
>Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
>---
> .../prog/en/modules/reports/guided_reports_start.tt        | 2 +-
> .../prog/en/modules/tools/batch_modify_holds.tt            | 7 ++++---
> tools/batch_modify_holds.pl                                | 2 +-
> 3 files changed, 6 insertions(+), 5 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
>index 1685165548..a2e8add680 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
>@@ -1018,7 +1018,7 @@
>                                     </textarea>
>                                 </form>
> 
>-                                <form method="POST" action="/cgi-bin/koha/tools/batch_modify_holds.pl" id="batch_modify_holds">
>+                                <form method="get" action="/cgi-bin/koha/tools/batch_modify_holds.pl" id="batch_modify_holds">
>                                     <input type="hidden" name="op" value="list" />
>                                     [% FOREACH result IN results %]
>                                         [% FOREACH cells IN result.cells %]
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_modify_holds.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_modify_holds.tt
>index 7705c36beb..6b96176498 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_modify_holds.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_modify_holds.tt
>@@ -42,7 +42,7 @@
>                     <h1>Batch modify holds</h1>
> 
>                     [% IF view == 'form' %]
>-                        <form method="post" action="/cgi-bin/koha/tools/batch_modify_holds.pl" id="modify_holds_form">
>+                        <form method="get" action="/cgi-bin/koha/tools/batch_modify_holds.pl" id="modify_holds_form">
>                             <fieldset class="rows">
>                                 <legend>Hold search criteria:</legend>
>                                 <span class="hint">NOTE! Column patron_expiration_date is used as a main filter for expiration date field. Otherwise column expirationdate is used.</span>
>@@ -106,6 +106,7 @@
>                         </form> 
>                     [% ELSIF view == 'list' %]
>                         <form action="/cgi-bin/koha/tools/batch_modify_holds.pl" method="post" id="process">
>+                            [% INCLUDE 'csrf-token.inc' %]
>                         [% IF holds.count %]
>                             <div class="page-section">
>                                 <div class="btn-toolbar selections-toolbar">
>@@ -189,7 +190,7 @@
>                                 </tbody>
>                             </table> 
>                             <fieldset class="action">
>-                                <input type="hidden" name="op" value="modify"/>
>+                                <input type="hidden" name="op" value="cud-modify"/>
>                                 <input type="submit" class="btn btn-primary" value="Modify selected holds"/>
>                                 <a class="cancel" href="/cgi-bin/koha/tools/batch_modify_holds.pl">Cancel</a>
>                             </fieldset>
>@@ -310,4 +311,4 @@
>     </script>
> [% END %]
> 
>-[% INCLUDE 'intranet-bottom.inc' %]
>\ No newline at end of file
>+[% INCLUDE 'intranet-bottom.inc' %]
>diff --git a/tools/batch_modify_holds.pl b/tools/batch_modify_holds.pl
>index ddc08e3adc..839f682eca 100755
>--- a/tools/batch_modify_holds.pl
>+++ b/tools/batch_modify_holds.pl
>@@ -124,7 +124,7 @@ elsif ( $op eq 'list' ) {
>     );
> }
> 
>-if ( $op eq 'modify' ) {
>+if ( $op eq 'cud-modify' ) {
> 
>     my $new_expiration_date = $input->param('new_expiration_date');
>     my $new_pickup_loc      = $input->param('new_pickup_loc');
>-- 
>2.30.2

Actions: View | Diff | Splinter Review

Attachments on bug 36135: 163021 | 163022 | 163023 | 163024 | 163529 | 163530 | 163540 | 163541 | 163542 | 163543 | 163544 | 163796 | 164037 | 164051 | 164057 | 164058 | 164059 | 164060 | 164061 | 164062 | 164063