Attachment 171701 Details for Bug 37959 – Bug 37979: Toggling Item circulation alerts table cells needs to send csrf_token

[patch] Bug 37979: Toggling Item circulation alerts table cells needs to send csrf_token

Bug-37979-Toggling-Item-circulation-alerts-table-c.patch (text/plain), 2.01 KB, created by Jan Kissig on 2024-09-19 06:40:00 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jan Kissig

Created: 2024-09-19 06:40:00 UTC

Size: 2.01 KB

patch

obsolete

>From d4a4f610eb49918dd57496fd095304452c46575c Mon Sep 17 00:00:00 2001
>From: Phil Ringnalda <phil@chetcolibrary.org>
>Date: Wed, 18 Sep 2024 19:41:50 -0700
>Subject: [PATCH] Bug 37979: Toggling Item circulation alerts table cells needs
> to send csrf_token
>
>When you click on a cell in the Item circulation alerts table, the page sends
>a POST to /cgi-bin/koha/admin/item_circulation_alerts.pl without including a
>csrf_token, which gets back a 403 error because that's sketchy behavior. It
>needs to include the token.
>
>Test plan:
>1. Administration - Item circulation alerts
>2. Open the browser devtools to the console
>3. Click on any green table cell
>4. It should have turned red, but instead your console turned red with a 403
>5. Apply patch, reload
>6. Click on any green table cell, it will turn red
>
>Sponsored-by: Chetco Community Public Library
>
>https://bugs.koha-community.org/show_bug.cgi?id=37959
>Signed-off-by: Jan Kissig <jkissig@th-wildau.de>
>---
> .../prog/en/modules/admin/item_circulation_alerts.tt            | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/item_circulation_alerts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/item_circulation_alerts.tt
>index dfa941fd46..d3f9b770d5 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/item_circulation_alerts.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/item_circulation_alerts.tt
>@@ -211,7 +211,7 @@
>                         url      : '/cgi-bin/koha/admin/item_circulation_alerts.pl',
>                         type     : 'POST',
>                         dataType : 'json',
>-                        data     : { op: 'cud-toggle', id: id, branch: $branch },
>+                        data     : { op: 'cud-toggle', id: id, branch: $branch, csrf_token: $('meta[name="csrf-token"]').attr("content") },
>                         success  : function(response){
>                             if ($branch == '*' && response.classes.match(/default/)) {
>                                 td.html(disabledForAll);
>-- 
>2.34.1

Actions: View | Diff | Splinter Review

Attachments on bug 37959: 171699 | 171701 | 171821