Attachment 170959 Details for Bug 37785 – Bug 37785: Remove dead code in tools/letter.tt that looks like a form that would POST without an op

[patch] Bug 37785: Remove dead code in tools/letter.tt that looks like a form that would POST without an op

Bug-37785-Remove-dead-code-in-toolslettertt-that-l.patch (text/plain), 2.80 KB, created by Jonathan Druart on 2024-09-03 08:31:39 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2024-09-03 08:31:39 UTC

Size: 2.80 KB

patch

obsolete

>From 73fa3c2b4c3806e204450857b8959b52ebee54ad Mon Sep 17 00:00:00 2001
>From: Phil Ringnalda <phil@chetcolibrary.org>
>Date: Thu, 29 Aug 2024 21:17:09 -0700
>Subject: [PATCH] Bug 37785: Remove dead code in tools/letter.tt that looks
> like a form that would POST without an op
>
>We intend not to have forms with method="post" without an op variable (so we
>can check that the op starts with "cud-" as part of the CSRF protection), but
>because of bug 37728 some were missed.
>
>The two in tools/letter.tt are blocks of never-used code which would display
>a message confirming that you saved a notice, or that a notice was deleted
>after you confirmed that you wanted to delete it, but neither one has ever
>been executed. Now, the names of the ops don't match, because they are
>cud-add_validate etc. and would have to explicitly set a param for
>add_validate, but even before the CSRF change to cud- ops, they explicitly
>unset their $op so that as they say "# we return to the default screen for
>the next operation". Prior to that, they just did
>"print $input->redirect("letter.pl");"
>
>No test plan is possible, since this code has never once done anything.
>
>Sponsored-by: Chetco Community Public Library
>
>Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>---
> .../prog/en/modules/tools/letter.tt              | 16 ----------------
> 1 file changed, 16 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt
>index c8fea2b3787..abc1402005d 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt
>@@ -549,14 +549,6 @@
>                     </form> 
>                 [% END # /IF add_form %]
> 
>-                [% IF ( add_validate or copy_validate) %]
>-                    Data recorded
>-                    <form action="[% action | html %]" method="post">
>-                        [% INCLUDE 'csrf-token.inc' %]
>-                        <input type="submit" class="btn btn-primary" value="OK" />
>-                    </form>
>-                [% END %]
>-
>                 [% IF ( delete_confirm ) %]
>                     <div class="alert alert-warning">
>                         <h1>Delete notice?</h1>
>@@ -591,14 +583,6 @@
>                     </div>
>                 [% END # /IF delete_confirm %]
> 
>-                [% IF ( delete_confirmed ) %]
>-                    <span>Data deleted</span>
>-                    <form action="[% action | html %]" method="post">
>-                        [% INCLUDE 'csrf-token.inc' %]
>-                    <input type="submit" class="btn btn-primary" value="OK" />
>-                    </form>
>-                [% END %]
>-
>     [% IF add_form or copy_form %]
>             </div> 
>         </div> 
>-- 
>2.34.1

Actions: View | Diff | Splinter Review

Attachments on bug 37785: 170899 | 170959 | 171266