Attachment 170941 Details for Bug 37794 – Bug 37794: Fix form that POSTs without an op in Holds to pull

[patch] Bug 37794: Fix form that POSTs without an op in Holds to pull

Bug-37794-Fix-form-that-POSTs-without-an-op-in-Hol.patch (text/plain), 1.83 KB, created by Jonathan Druart on 2024-09-02 13:24:49 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2024-09-02 13:24:49 UTC

Size: 1.83 KB

patch

obsolete

>From 46328c77770ec7c21f651b782f3d78dc2ff2bdda Mon Sep 17 00:00:00 2001
>From: Phil Ringnalda <phil@chetcolibrary.org>
>Date: Fri, 30 Aug 2024 10:04:12 -0700
>Subject: [PATCH] Bug 37794: Fix form that POSTs without an op in Holds to pull
>
>We intend not to have forms with method="post" without an op variable (so we
>can check that the op starts with "cud-" as part of the CSRF protection), but
>because of bug 37728 some were missed.
>
>In Holds to pull that's the form which lets you change from the default
>starting and ending date. Switching that to a GET at least lets you refresh
>the page without getting a browser warning about resending a POST and maybe
>having your credit card double-charged.
>
>Test plan:
>1. Without the patch, Circulation - Holds to pull - change the start date to
>   something earlier and click Submit
>2. Refresh the page, get a warning about resubmitting data
>3. Apply patch, Circulation - Holds to pull - change the start date to
>   something earlier and click Submit
>4. Refresh the page, no warning
>
>Sponsored-by: Chetco Community Public Library
>
>Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>---
> .../intranet-tmpl/prog/en/modules/circ/pendingreserves.tt      | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt
>index 55578ee95c5..cd1c237287b 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt
>@@ -287,8 +287,7 @@
> 
> <div id="filters">
> 
>-<form action="/cgi-bin/koha/circ/pendingreserves.pl" method="post" >
>-    [% INCLUDE 'csrf-token.inc' %]
>+<form action="/cgi-bin/koha/circ/pendingreserves.pl" method="get" >
> <fieldset class="brief">
> <h4>Refine results</h4>
> <ol>
>-- 
>2.34.1

Actions: View | Diff | Splinter Review

Attachments on bug 37794: 170922 | 170941