Bugzilla – Attachment 170422 Details for
Bug 37614
Printing patron cards from patron lists broken by CSRF protection
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 37614: Printing patron cards from patron lists should be a GET
Bug-37614-Printing-patron-cards-from-patron-lists-.patch (text/plain), 5.18 KB, created by
Marcel de Rooy
on 2024-08-16 06:22:22 UTC
(
hide
)
Description:
Bug 37614: Printing patron cards from patron lists should be a GET
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2024-08-16 06:22:22 UTC
Size:
5.18 KB
patch
obsolete
>From 583f12e48a73a950287cb5bea79657dab1e9b1bf Mon Sep 17 00:00:00 2001 >From: Phil Ringnalda <phil@chetcolibrary.org> >Date: Thu, 15 Aug 2024 17:44:20 -0700 >Subject: [PATCH] Bug 37614: Printing patron cards from patron lists should be > a GET >Content-Type: text/plain; charset=utf-8 > >There's no creating, updating, or deleting about printing patron cards, and >the only time there's a lot of data (selecting individual patrons in a card >creator batch), it doesn't matter if the "Export selected" URL exceeds the >maxlength for Apache since the actual link to create the PDF also will. > >Test plan: > 1. Without the patch, Tools - Patron lists - New patron list - Name it and > Save > 2. Type three characters in the Patron search form (mar works well) to get > at least three patrons. Click on each of three, then click Add patrons > 3. You can only print cards from the list of lists, so back to Tools - > Patron lists > 4. In the Actions menu choose Print patron cards, in the popup click Export > 5. Watch the throbber spin around for a while (it will never stop), then > close the popup, apply the patch, restart_all > 6. Tools - Patron lists - Actions menu - Print patron cards - Export > 7. Click the PDF link, make sure it has all three of your patrons > 8. Tools - Patron card creator - New - Card batch > 9. Without putting anything in the textarea, click Add patrons, in the > search popup search for your three characters (mar) again, and click > the checkboxes to the left of three of the names, then Add selected > patrons, then Close, then Add patrons >10. Click the checkboxes for two of the three patrons, then Export selected > card(s), then Export in the popup >11. Hover the link to the PDF, verify that it doesn't have stray 'amp;' > after the & and before label_id= anymore >12. Click the PDF link, verify it has your two patrons >13. Back at the card batch, click Export card batch, then Export >14. Check the PDF to verify it has all three of your patrons >15. Tools - Patron lists - click your list's name to open it >16. Click the card number for a patron, then the Patron lists tab in Checkout >17. Actions menu - Print patron cards - Export, verify the PDF has all three > patrons > >Signed-off-by: David Nind <david@davidnind.com> > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > .../intranet-tmpl/prog/en/modules/patroncards/print.tt | 5 ++--- > patroncards/print.pl | 10 +++++----- > 2 files changed, 7 insertions(+), 8 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt >index 2ce35c8789..5282c640e8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt >@@ -61,9 +61,8 @@ > [% IF ( multi_batch_count == 1 ) %]<span>1 batch to export</span>[% ELSE %]<span>[% multi_batch_count | html %] batches to export</span>[% END %] > [% END %] > </h3> >- <form id="exportingf" name="exporting" method="post" action="/cgi-bin/koha/patroncards/print.pl"> >- [% INCLUDE 'csrf-token.inc' %] >- <input type="hidden" name="op" value="cud-export" /> >+ <form id="exportingf" name="exporting" method="get" action="/cgi-bin/koha/patroncards/print.pl"> >+ <input type="hidden" name="op" value="export" /> > <input type="hidden" name="referer" value="[% referer | html %]" /> > [% FOREACH batch_id IN batch_ids %] > <input type="hidden" name="batch_id" value="[% batch_id.batch_id | html %]" /> >diff --git a/patroncards/print.pl b/patroncards/print.pl >index 14c99e5387..c45e91a945 100755 >--- a/patroncards/print.pl >+++ b/patroncards/print.pl >@@ -56,10 +56,10 @@ my $multi_batch_count = scalar(@batch_ids); > my $card_count = scalar(@label_ids); > my $borrower_count = scalar(@borrower_numbers); > >-if ($op eq 'cud-export') { #FIXME Seems like a GET operation? >+if ($op eq 'export') { > if (@label_ids) { >- my $label_id_param = '&label_id='; >- $label_id_param .= join ('&label_id=',@label_ids); >+ my $label_id_param = '&label_id='; >+ $label_id_param .= join ('&label_id=',@label_ids); > push (@batches, {create_script => ($output_format eq 'pdf' ? 'create-pdf.pl' : 'create-csv.pl'), #FIXME csv not supported, no script? > batch_id => $batch_ids[0], > template_id => $template_id, >@@ -75,8 +75,8 @@ if ($op eq 'cud-export') { #FIXME Seems like a GET operation? > ); > } > elsif (@borrower_numbers) { >- my $borrower_number_param = '&borrower_number='; >- $borrower_number_param .= join ('&borrower_number=',@borrower_numbers); >+ my $borrower_number_param = '&borrower_number='; >+ $borrower_number_param .= join ('&borrower_number=',@borrower_numbers); > push (@batches, {create_script => ($output_format eq 'pdf' ? 'create-pdf.pl' : 'create-csv.pl'), #FIXME csv not supported, no script? > template_id => $template_id, > layout_id => $layout_id, >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 37614
:
170416
|
170417
| 170422