From b2c27c5ac6b37e384b65094b9c16c9e37c3460eb Mon Sep 17 00:00:00 2001 From: Martin Renvoize <martin.renvoize@ptfs-europe.com> Date: Thu, 16 Sep 2021 15:13:23 +0100 Subject: [PATCH] Bug 22990: Fix for shelves table --- .../prog/en/modules/virtualshelves/shelves.tt | 3 +++ .../en/modules/virtualshelves/tables/shelves_results.tt | 2 ++ virtualshelves/shelves.pl | 8 +++++++- 3 files changed, 12 insertions(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt index b2f12a4b4e..d8d38f61c6 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt @@ -188,6 +188,7 @@ <h3>Contents of <em>[% shelf.shelfname | html %]</em></h3> <div class="pages">[% pagination_bar | $raw %]</div> <form action="/cgi-bin/koha/virtualshelves/shelves.pl" id="listform" method="post"> + [% INCLUDE 'csrf-token.inc' %] <input type="hidden" name="op" value="remove_biblios" /> <input type="hidden" name="referer" value="view" /> <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]" /> @@ -316,6 +317,7 @@ [% IF op == 'add_form' OR op == 'edit_form' %] <form method="post" action="/cgi-bin/koha/virtualshelves/shelves.pl" class="validated"> + [% INCLUDE 'csrf-token.inc' %] <fieldset class="rows"> [% IF op == 'add_form' %] @@ -450,6 +452,7 @@ <div class="modal" id="addToList" tabindex="-1" role="dialog" aria-labelledby="addToListLabel"> <div class="modal-dialog" role="document"> <form action="/cgi-bin/koha/virtualshelves/shelves.pl" method="post"> + [% INCLUDE 'csrf-token.inc' %] <div class="modal-content"> <div class="modal-header"> <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">×</span></button> diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt index 8a1dbdc18b..7e1e615a7a 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt @@ -38,6 +38,7 @@ [%~ type = type | html ~%] [%~ IF can_manage_shelf ~%] [%~ action_block = '<form action="shelves.pl" method="get">' ~%] + [%~ action_block = action_block _ '[% INCLUDE 'csrf-token.inc' %]' ~%] [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber _ '" />' ~%] [%~ action_block = action_block _ '<input type="hidden" name="op" value="edit_form" />' ~%] [%~ action_block = action_block _ '<input type="hidden" name="category" value="' _ type _ '" />' ~%] @@ -47,6 +48,7 @@ [%~ END ~%] [%~ IF can_manage_shelf OR can_delete_shelf ~%] [%~ action_block = action_block _ ' <form action="shelves.pl" method="post">' ~%] + [%~ action_block = action_block _ '[% INCLUDE 'csrf-token.inc' %]' ~%] [%~ action_block = action_block _ '<input type="hidden" name="shelves" value="1" />' ~%] [%~ action_block = action_block _ '<input type="hidden" name="op" value="delete" />' ~%] [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber _ '" />' ~%] diff --git a/virtualshelves/shelves.pl b/virtualshelves/shelves.pl index 25f2127b1c..eb66b1366a 100755 --- a/virtualshelves/shelves.pl +++ b/virtualshelves/shelves.pl @@ -29,7 +29,7 @@ use C4::Koha qw( ); use C4::Items qw( GetItemsLocationInfo ); use C4::Members; -use C4::Output qw( pagination_bar output_html_with_http_headers ); +use C4::Output qw( pagination_bar output_html_with_http_headers output_and_exit_if_error ); use C4::XSLT qw( XSLTParse4Display ); use Koha::Biblios; @@ -61,6 +61,7 @@ if ( $op eq 'add_form' ) { # Only pass default $shelf = { allow_change_from_owner => 1 }; } elsif ( $op eq 'edit_form' ) { + output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' }); $shelfnumber = $query->param('shelfnumber'); $shelf = Koha::Virtualshelves->find($shelfnumber); @@ -76,6 +77,7 @@ if ( $op eq 'add_form' ) { push @messages, { type => 'alert', code => 'does_not_exist' }; } } elsif ( $op eq 'add' ) { + output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' }); my $allow_changes_from = $query->param('allow_changes_from'); eval { $shelf = Koha::Virtualshelf->new( @@ -100,6 +102,7 @@ if ( $op eq 'add_form' ) { $op = 'view'; } } elsif ( $op eq 'edit' ) { + output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' }); $shelfnumber = $query->param('shelfnumber'); $shelf = Koha::Virtualshelves->find($shelfnumber); @@ -129,6 +132,7 @@ if ( $op eq 'add_form' ) { push @messages, { type => 'alert', code => 'does_not_exist' }; } } elsif ( $op eq 'delete' ) { + output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' }); $shelfnumber = $query->param('shelfnumber'); $shelf = Koha::Virtualshelves->find($shelfnumber); if ($shelf) { @@ -147,6 +151,7 @@ if ( $op eq 'add_form' ) { } $op = 'list'; } elsif ( $op eq 'add_biblio' ) { + output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' }); $shelfnumber = $query->param('shelfnumber'); $shelf = Koha::Virtualshelves->find($shelfnumber); if ($shelf) { @@ -203,6 +208,7 @@ if ( $op eq 'add_form' ) { } $op = $referer; } elsif ( $op eq 'remove_biblios' ) { + output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' }); $shelfnumber = $query->param('shelfnumber'); $shelf = Koha::Virtualshelves->find($shelfnumber); my @biblionumbers = $query->multi_param('biblionumber'); -- 2.20.1