Bugzilla – Attachment 179959 Details for
Bug 31632
Add ability to manually link orders to suggestions
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 31632: (follow-up) CSRF protection for linking order to suggestion
Bug-31632-follow-up-CSRF-protection-for-linking-or.patch (text/plain), 5.11 KB, created by
Nick Clemens (kidclamp)
on 2025-03-31 09:49:29 UTC
(
hide
)
Description:
Bug 31632: (follow-up) CSRF protection for linking order to suggestion
Filename:
MIME Type:
Creator:
Nick Clemens (kidclamp)
Created:
2025-03-31 09:49:29 UTC
Size:
5.11 KB
patch
obsolete
>From 0ad208369eb8f443863a278b00e9b59af3b4a2bf Mon Sep 17 00:00:00 2001 >From: Aleisha Amohia <aleishaamohia@hotmail.com> >Date: Mon, 2 Sep 2024 23:55:00 +0000 >Subject: [PATCH] Bug 31632: (follow-up) CSRF protection for linking order to > suggestion > >Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com> >Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> >--- > acqui/newordersuggestion.pl | 2 +- > .../intranet-tmpl/prog/en/modules/acqui/basket.tt | 3 ++- > .../prog/en/modules/acqui/newordersuggestion.tt | 12 ++++++++++-- > 3 files changed, 13 insertions(+), 4 deletions(-) > >diff --git a/acqui/newordersuggestion.pl b/acqui/newordersuggestion.pl >index 33fb3fc8d96..429b6702f7d 100755 >--- a/acqui/newordersuggestion.pl >+++ b/acqui/newordersuggestion.pl >@@ -129,7 +129,7 @@ if ( $op eq 'connectDuplicate' ) { > ConnectSuggestionAndBiblio( $suggestionid, $duplicateNumber ); > } > >-if ( $op eq 'link_order' and $link_order ) { >+if ( $op eq 'cud-link_order' and $link_order ) { > my $order = Koha::Acquisition::Orders->find($link_order); > my $suggestion = Koha::Suggestions->find($suggestionid); > $suggestion->update( { biblionumber => $order->biblionumber } ) if $order->biblionumber; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt >index a640a31c716..509bd59dafc 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt >@@ -738,7 +738,7 @@ > <br /> > [% END %] > [% UNLESS ( books_loo.suggestionid ) %] >- <a href="/cgi-bin/koha/acqui/newordersuggestion.pl?booksellerid=[% booksellerid | uri %]&basketno=[% basketno | uri %]&link_order=[% books_loo.ordernumber | uri %]">[% tp('verb', 'Link suggestion') | html %]</a> >+ <a data-action="/cgi-bin/koha/acqui/newordersuggestion.pl" data-booksellerid="[% booksellerid | uri %]" data-basketno="[% basketno | uri %]" data-link_order="[% books_loo.ordernumber | uri %]" data-method="post" class="submit-form-link" href="#">[% tp('verb', 'Link suggestion') | html %]</a> > [% END %] > </td> > [% END %] >@@ -1026,6 +1026,7 @@ > [% Asset.js("js/form-submit.js") | $raw %] > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/acq.js") | $raw %] >+ [% Asset.js("js/form-submit.js") | $raw %] > [% INCLUDE 'calendar.inc' %] > <script> > function updateColumnsVisibility(visible) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt >index a1b375b5170..bf52cae60d1 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt >@@ -95,8 +95,15 @@ > <td class="actions"> > [% IF link_order %] > <a >- href="/cgi-bin/koha/acqui/newordersuggestion.pl?op=link_order&link_order=[% link_order | uri %]&booksellerid=[% booksellerid | uri %]&basketno=[% basketno | uri %]&suggestionid=[% suggestion.suggestionid | uri %]" >- class="btn btn-default btn-xs" >+ data-action="/cgi-bin/koha/acqui/newordersuggestion.pl" >+ data-op="cud-link_order" >+ data-link_order="[% link_order | uri %]" >+ data-booksellerid="[% booksellerid | uri %]" >+ data-basketno="[% basketno | uri %]" >+ data-suggestionid="[% suggestion.suggestionid | uri %]" >+ data-method="post" >+ class="btn btn-default btn-xs submit-form-link" >+ href="#" > ><i class="fa fa-plus"></i> [% tp('verb', 'Link suggestion') | html %]</a > > > [% ELSIF ( suggestion.biblionumber ) %] >@@ -133,6 +140,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/acquisitions-menu.js") | $raw %] >+ [% Asset.js("js/form-submit.js") | $raw %] > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'calendar.inc' %] > <script> >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 31632
:
141028
|
141029
|
141030
|
169391
|
170147
|
170148
|
170953
|
174393
|
174394
|
174395
|
174415
|
174416
|
174417
|
175620
|
175621
|
175622
|
175623
|
175624
|
176281
|
176282
|
179957
|
179958
| 179959 |
179960
|
179961
|
179962