Attachment 170953 Details for Bug 31632 – Bug 31632: (follow-up) CSRF protection for linking order to suggestion

[patch] Bug 31632: (follow-up) CSRF protection for linking order to suggestion

Bug-31632-follow-up-CSRF-protection-for-linking-or.patch (text/plain), 4.78 KB, created by Aleisha Amohia on 2024-09-02 23:55:56 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Aleisha Amohia

Created: 2024-09-02 23:55:56 UTC

Size: 4.78 KB

patch

obsolete

>From 4c0de7747b32ab6ffcc1e7f583f882ec87ad3e44 Mon Sep 17 00:00:00 2001
>From: Aleisha Amohia <aleishaamohia@hotmail.com>
>Date: Mon, 2 Sep 2024 23:55:00 +0000
>Subject: [PATCH] Bug 31632: (follow-up) CSRF protection for linking order to
> suggestion
>
>---
> acqui/newordersuggestion.pl                                    | 2 +-
> koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt        | 3 ++-
> .../intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt  | 3 ++-
> 3 files changed, 5 insertions(+), 3 deletions(-)
>
>diff --git a/acqui/newordersuggestion.pl b/acqui/newordersuggestion.pl
>index fec5a2ef10f..3c467892f75 100755
>--- a/acqui/newordersuggestion.pl
>+++ b/acqui/newordersuggestion.pl
>@@ -129,7 +129,7 @@ if ( $op eq 'connectDuplicate' ) {
>     ConnectSuggestionAndBiblio( $suggestionid, $duplicateNumber );
> }
> 
>-if ( $op eq 'link_order' and $link_order ) {
>+if ( $op eq 'cud-link_order' and $link_order ) {
>     my $order      = Koha::Acquisition::Orders->find($link_order);
>     my $suggestion = Koha::Suggestions->find($suggestionid);
>     $suggestion->update( { biblionumber => $order->biblionumber } ) if $order->biblionumber;
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
>index d9c32b2cf1b..26cf15d05f7 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
>@@ -726,7 +726,7 @@
>                                                                     <br />
>                                                                 [% END %]
>                                                                 [% UNLESS ( books_loo.suggestionid ) %]
>-                                                                    <a href="/cgi-bin/koha/acqui/newordersuggestion.pl?booksellerid=[% booksellerid | uri %]&amp;basketno=[% basketno | uri %]&amp;link_order=[% books_loo.ordernumber | uri %]">[% tp('verb', 'Link suggestion') | html %]</a>
>+                                                                    <a data-action="/cgi-bin/koha/acqui/newordersuggestion.pl" data-booksellerid="[% booksellerid | uri %]" data-basketno="[% basketno | uri %]" data-link_order="[% books_loo.ordernumber | uri %]" data-method="post" class="submit-form-link" href="#">[% tp('verb', 'Link suggestion') | html %]</a>
>                                                                 [% END %]
>                                                             </td>
>                                                         [% END %]
>@@ -1015,6 +1015,7 @@
>     [% INCLUDE 'columns_settings.inc' %]
>     [% Asset.js("lib/hc-sticky/hc-sticky.js") | $raw %]
>     [% Asset.js("js/acq.js") | $raw %]
>+    [% Asset.js("js/form-submit.js") | $raw %]
>     [% INCLUDE 'calendar.inc' %]
>     <script>
>         function updateColumnsVisibility(visible) {
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt
>index 226794e2361..0325064bc27 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt
>@@ -101,7 +101,7 @@
>                             </td>
>                             <td class="actions">
>                                 [% IF link_order %]
>-                                    <a href="/cgi-bin/koha/acqui/newordersuggestion.pl?op=link_order&amp;link_order=[% link_order | uri %]&amp;booksellerid=[% booksellerid | uri %]&amp;basketno=[% basketno | uri %]&amp;suggestionid=[% suggestion.suggestionid | uri %]" class="btn btn-default btn-xs"><i class="fa fa-plus"></i> [% tp('verb', 'Link suggestion') | html %]</a>
>+                                    <a data-action="/cgi-bin/koha/acqui/newordersuggestion.pl" data-op="cud-link_order" data-link_order="[% link_order | uri %]" data-booksellerid="[% booksellerid | uri %]" data-basketno="[% basketno | uri %]" data-suggestionid="[% suggestion.suggestionid | uri %]" data-method="post" class="btn btn-default btn-xs submit-form-link" href="#"><i class="fa fa-plus"></i> [% tp('verb', 'Link suggestion') | html %]</a>
>                                 [% ELSIF ( suggestion.biblionumber ) %]
>                                     <a href="neworderempty.pl?booksellerid=[% booksellerid | uri %]&amp;basketno=[% basketno | uri %]&amp;suggestionid=[% suggestion.suggestionid | uri %]&amp;biblio=[% suggestion.biblionumber | uri %]" class="btn btn-default btn-xs"><i class="fa fa-plus"></i> [% tp('verb', 'Order') | html %]</a>
>                                 [% ELSE %]
>@@ -128,6 +128,7 @@
> 
> [% MACRO jsinclude BLOCK %]
>     [% Asset.js("js/acquisitions-menu.js") | $raw %]
>+    [% Asset.js("js/form-submit.js") | $raw %]
>     [% INCLUDE 'datatables.inc' %]
>     [% INCLUDE 'calendar.inc' %]
>     <script>
>-- 
>2.39.2

Actions: View | Diff | Splinter Review

Attachments on bug 31632: 141028 | 141029 | 141030 | 169391 | 170147 | 170148 | 170953 | 174393 | 174394 | 174395 | 174415 | 174416 | 174417