Attachment 171821 Details for Bug 37959 – Bug 37979: Toggling Item circulation alerts table cells needs to send csrf_token

[patch] Bug 37979: Toggling Item circulation alerts table cells needs to send csrf_token

Bug-37979-Toggling-Item-circulation-alerts-table-c.patch (text/plain), 2.11 KB, created by Marcel de Rooy on 2024-09-20 07:21:55 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2024-09-20 07:21:55 UTC

Size: 2.11 KB

patch

obsolete

>From 555876fbf6dc8ef25bffb2fc0ecdba06fcaf68eb Mon Sep 17 00:00:00 2001
>From: Phil Ringnalda <phil@chetcolibrary.org>
>Date: Wed, 18 Sep 2024 19:41:50 -0700
>Subject: [PATCH] Bug 37979: Toggling Item circulation alerts table cells needs
> to send csrf_token
>Content-Type: text/plain; charset=utf-8
>
>When you click on a cell in the Item circulation alerts table, the page sends
>a POST to /cgi-bin/koha/admin/item_circulation_alerts.pl without including a
>csrf_token, which gets back a 403 error because that's sketchy behavior. It
>needs to include the token.
>
>Test plan:
>1. Administration - Item circulation alerts
>2. Open the browser devtools to the console
>3. Click on any green table cell
>4. It should have turned red, but instead your console turned red with a 403
>5. Apply patch, reload
>6. Click on any green table cell, it will turn red
>
>Sponsored-by: Chetco Community Public Library
>
>https://bugs.koha-community.org/show_bug.cgi?id=37959
>Signed-off-by: Jan Kissig <jkissig@th-wildau.de>
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>---
> .../prog/en/modules/admin/item_circulation_alerts.tt            | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/item_circulation_alerts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/item_circulation_alerts.tt
>index dfa941fd46..d3f9b770d5 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/item_circulation_alerts.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/item_circulation_alerts.tt
>@@ -211,7 +211,7 @@
>                         url      : '/cgi-bin/koha/admin/item_circulation_alerts.pl',
>                         type     : 'POST',
>                         dataType : 'json',
>-                        data     : { op: 'cud-toggle', id: id, branch: $branch },
>+                        data     : { op: 'cud-toggle', id: id, branch: $branch, csrf_token: $('meta[name="csrf-token"]').attr("content") },
>                         success  : function(response){
>                             if ($branch == '*' && response.classes.match(/default/)) {
>                                 td.html(disabledForAll);
>-- 
>2.30.2

Actions: View | Diff | Splinter Review

Attachments on bug 37959: 171699 | 171701 | 171821