Attachment 170922 Details for Bug 37794 – Bug 37794: Fix form that POSTs without an op in Holds to pull

[patch] Bug 37794: Fix form that POSTs without an op in Holds to pull

Bug-37794-Fix-form-that-POSTs-without-an-op-in-Hol.patch (text/plain), 1.76 KB, created by Phil Ringnalda on 2024-08-30 17:09:51 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Phil Ringnalda

Created: 2024-08-30 17:09:51 UTC

Size: 1.76 KB

patch

obsolete

>From 7dc5387aeb5fb93ba95083fdefad98cd48c67f63 Mon Sep 17 00:00:00 2001
>From: Phil Ringnalda <phil@chetcolibrary.org>
>Date: Fri, 30 Aug 2024 10:04:12 -0700
>Subject: [PATCH] Bug 37794: Fix form that POSTs without an op in Holds to pull
>
>We intend not to have forms with method="post" without an op variable (so we
>can check that the op starts with "cud-" as part of the CSRF protection), but
>because of bug 37728 some were missed.
>
>In Holds to pull that's the form which lets you change from the default
>starting and ending date. Switching that to a GET at least lets you refresh
>the page without getting a browser warning about resending a POST and maybe
>having your credit card double-charged.
>
>Test plan:
>1. Without the patch, Circulation - Holds to pull - change the start date to
>   something earlier and click Submit
>2. Refresh the page, get a warning about resubmitting data
>3. Apply patch, Circulation - Holds to pull - change the start date to
>   something earlier and click Submit
>4. Refresh the page, no warning
>
>Sponsored-by: Chetco Community Public Library
>---
> .../intranet-tmpl/prog/en/modules/circ/pendingreserves.tt      | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt
>index 55578ee95c..cd1c237287 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt
>@@ -287,8 +287,7 @@
> 
> <div id="filters">
> 
>-<form action="/cgi-bin/koha/circ/pendingreserves.pl" method="post" >
>-    [% INCLUDE 'csrf-token.inc' %]
>+<form action="/cgi-bin/koha/circ/pendingreserves.pl" method="get" >
> <fieldset class="brief">
> <h4>Refine results</h4>
> <ol>
>-- 
>2.44.0

Actions: View | Diff | Splinter Review

Attachments on bug 37794: 170922 | 170941