Attachment 173858 Details for Bug 38309 – Bug 38309: Cannot delete additional fields

[patch] Bug 38309: Cannot delete additional fields

Bug-38309-Cannot-delete-additional-fields.patch (text/plain), 3.05 KB, created by David Nind on 2024-11-01 08:44:12 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: David Nind

Created: 2024-11-01 08:44:12 UTC

Size: 3.05 KB

patch

obsolete

>From 188bad041171d6a690800f6a3166d571d5a83dca Mon Sep 17 00:00:00 2001
>From: Phil Ringnalda <phil@chetcolibrary.org>
>Date: Thu, 31 Oct 2024 19:44:35 -0700
>Subject: [PATCH] Bug 38309: Cannot delete additional fields
>
>Deleting an additional field tries to do a GET of ?op=delete... which no
>longer works with CSRF protection. It needs to be a POST with op=cud-delete.
>
>Test plan:
> 1. Administration - Additional fields, click any table name
> 2. New field, fill in a name and Save
> 3. In the row for your field, click Delete
> 4. You have a blank page
> 5. Apply patch, click the browser Back button, refresh the page
> 6. In the row for your undeleted field, click Delete
> 7. Your field is deleted
>
>Sponsored-by: Chetco Community Public Library
>Signed-off-by: David Nind <david@davidnind.com>
>---
> .../prog/en/modules/admin/additional-fields.tt | 8 +++-----
> 1 file changed, 3 insertions(+), 5 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt
>index ed1c4af13e..02c7ab20e1 100755
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt
>@@ -1,5 +1,6 @@
> [% USE AuthorisedValues %]
> [% USE raw %]
>+[% USE Asset %]
> [% PROCESS 'i18n.inc' %]
> [% SET footerjs = 1 %]
> [% INCLUDE 'doc-head-open.inc' %]
>@@ -187,7 +188,7 @@
> </td>
> <td class="actions">
> <a class="btn btn-default btn-xs" href="?op=add_form&amp;field_id=[% field.id | html %]"> Edit</a>
>- <a class="confirmdelete btn btn-default btn-xs" href="?op=delete&amp;field_id=[% field.id | uri %]&amp;tablename=[% tablename | uri %]"> Delete</a>
>+ <a class="submit-form-link btn btn-default btn-xs" href="#" data-action="additional-fields.pl" data-method="post" data-op="cud-delete" data-field_id="[% field.id | html %]" data-tablename="[% tablename | html %]" data-confirmation-msg="[% t('Are you sure you want to delete this field?') | html %]"> Delete</a>
> </td>
> </tr>
> [% END %]
>@@ -287,6 +288,7 @@
> 
> [% MACRO jsinclude BLOCK %]
> [% INCLUDE "datatables.inc" %]
>+ [% Asset.js("js/form-submit.js") | $raw %]
> <script>
> $(document).ready(function(){
> $('#selecttable').find(":submit").hide();
>@@ -303,10 +305,6 @@
> "order": [[ 0, "asc" ]],
> }));
> 
>- $(".confirmdelete").click(function(){
>- return confirm(_("Are you sure you want to delete this field?"));
>- });
>-
> $("#add_field").on('submit', function() {
> if ( $("#marcfield").length && $("select[name='authorised_value_category']").length ) {
> if ( $("#marcfield").val().length > 0
>-- 
>2.39.5

Actions: View | Diff | Splinter Review

Attachments on bug 38309: 173851 | 173858 | 173885