Bugzilla – Attachment 182946 Details for
Bug 40061
Cannot delete image from patron card creator
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 40061: Add CSRF protection to patron image deletion
Bug-40061-Add-CSRF-protection-to-patron-image-dele.patch (text/plain), 4.59 KB, created by
Owen Leonard
on 2025-06-04 11:48:24 UTC
(
hide
)
Description:
Bug 40061: Add CSRF protection to patron image deletion
Filename:
MIME Type:
Creator:
Owen Leonard
Created:
2025-06-04 11:48:24 UTC
Size:
4.59 KB
patch
obsolete
>From a40c876563a9e988a494ddc9d21a42e0e87208b0 Mon Sep 17 00:00:00 2001 >From: Owen Leonard <oleonard@myacpl.org> >Date: Wed, 4 Jun 2025 11:04:01 +0000 >Subject: [PATCH] Bug 40061: Add CSRF protection to patron image deletion > >The patron image deletion operation was not fully updated in Bug 34478. >The individual "Delete" buttons in the table of images need to be >updated to use form-submit.js > >Unrelated: I removed an invalid "align" attribute from a <td>. > >To test, apply the patch and go to Tools -> Patron card creator -> Image >manager. > >- Upload multiple images >- Test the individual "Delete" buttons in the table of images. > - Test that both the "OK" and "Cancel" operations work correctly. >- Test the process of checking one or more checkboxes and clicking the > "Delete selected" button. > - Test that both the "OK" and "Cancel" operations work correctly. > >Sponsored-by: Athens County Public Libraries >--- > .../en/modules/patroncards/image-manage.tt | 31 ++++++------------- > 1 file changed, 9 insertions(+), 22 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt >index 3206ee48a84..c7b9d207e32 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt >@@ -105,13 +105,18 @@ > [% IF ( text_field.select_field ) %] > <td> > <a >- class="delete_image btn btn-default btn-xs" >+ class="btn btn-default btn-xs submit-form-link" >+ href="#" > data-image_id="[% text_field.field_value | html %]" >- href="/cgi-bin/koha/patroncards/image-manage.pl?op=delete&image_id=[% text_field.field_value | html %]" >- ><i class="fa fa-trash-can"></i> Delete</a >+ data-action="/cgi-bin/koha/patroncards/image-manage.pl" >+ data-method="post" >+ data-op="cud-delete" >+ data-confirmation-msg="[% tx('Are you sure you want to delete image {image_id}?', {image_id = text_field.field_value} ) | html %]" > > >+ <i class="fa fa-trash-can"></i> Delete >+ </a> > </td> >- <td align="center"><input type="checkbox" id="image_id_[% text_field.field_value | html %]" name="image_id" value="[% text_field.field_value | html %]" /></td> >+ <td><input type="checkbox" id="image_id_[% text_field.field_value | html %]" name="image_id" value="[% text_field.field_value | html %]" /></td> > [% ELSIF ( text_field.field_value ) %] > <td>[% text_field.field_value | html %]</td> > [% ELSE %] >@@ -186,24 +191,6 @@ > $("#delete").click(function () { > return DeleteConfirm(); > }); >- $(".delete_image").on("click", function (ev) { >- ev.preventDefault(); >- const this_image = ev.target; >- const image_id = this_image.dataset.image_id; >- for (i = 0; i < document.delete_images.image_id.length; i++) { >- const row_image_id = document.delete_images.image_id[i].value; >- const row_checkbox = document.querySelector(`#image_id_${row_image_id}`); >- if (image_id === row_image_id) { >- row_checkbox.checked = true; >- } else { >- row_checkbox.checked = false; >- } >- } >- const confirmed = confirmDelete(_("Are you sure you want to delete image: %s?").format(image_id)); >- if (confirmed) { >- document.delete_images.submit(); >- } >- }); > }); > </script> > [% END %] >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 40061
:
182946
|
182957
|
182959
|
182960
|
183039
|
183040