Attachment 165035 Details for Bug 36630 – Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons

[patch] Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons

Bug-36630-Change-Post-to-GET-to-fix-CSRF-error-on-.patch (text/plain), 1.94 KB, created by David Nind on 2024-04-18 02:26:46 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: David Nind

Created: 2024-04-18 02:26:46 UTC

Size: 1.94 KB

patch

obsolete

>From 665c2b64dbde7f8151c82243b9be909004bfec65 Mon Sep 17 00:00:00 2001
>From: Brendan Lawlor <blawlor@clamsnet.org>
>Date: Wed, 17 Apr 2024 20:57:34 +0000
>Subject: [PATCH] Bug 36630: Change Post to GET to fix CSRF error on item
> search batch operations buttons
>
>This patch changes the form that submits to batchMod.pl from the Item search results page. The form method does not need to be a POST.
>
>    To recreate:
>
>    1. Do an item search
>    2. On the results page 'click Select visible rows'
>    3. Click 'Batch operations' and select 'Batch item modification'
>    4. See Programming error - op 'show' must start with 'cud-' for POST http://localhost:8081/intranet/tools/batchMod.pl (referer: http://localhost:8081/cgi-bin/koha/catalogue/itemsearch.pl)
>    5. Click 'Batch operations' and select 'Batch item deletion'
>    6. See the same error
>
>    To test:
>    1. Apply patch and repeat steps to recreate the issue
>    2. See that the batchMod.pl page loads with no error.
>
>Signed-off-by: David Nind <david@davidnind.com>
>---
> .../intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt    | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt
>index 2b064b157f..be573fb7e1 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt
>@@ -279,9 +279,8 @@
>         </div>
>       </div>
> 
>-        <form method="POST" action="/cgi-bin/koha/tools/batchMod.pl" id="batch_item_operations">
>-            [% INCLUDE 'csrf-token.inc' %]
>-            <input type="hidden" name="op" value="cud-show" />
>+        <form method="GET" action="/cgi-bin/koha/tools/batchMod.pl" id="batch_item_operations">
>+            <input type="hidden" name="op" value="show" />
>             <input type="hidden" id="batch_mod_del" name="del" value="0" />
>         </form>
> 
>-- 
>2.39.2

Actions: View | Diff | Splinter Review

Attachments on bug 36630: 165034 | 165035 | 165036