From 64f509ec8708122094abc5076115a689d077ed5d Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Date: Thu, 16 Sep 2021 15:13:23 +0100
Subject: [PATCH] Bug 22990: Fix for shelves table

---
 .../prog/en/modules/virtualshelves/shelves.tt             | 3 +++
 .../en/modules/virtualshelves/tables/shelves_results.tt   | 2 ++
 virtualshelves/shelves.pl                                 | 8 +++++++-
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
index 2590f93592..359c877600 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
@@ -189,6 +189,7 @@
     <h3>Contents of <em>[% shelf.shelfname | html %]</em></h3>
     <div class="pages">[% pagination_bar | $raw %]</div>
     <form action="/cgi-bin/koha/virtualshelves/shelves.pl" id="listform" method="post">
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="hidden" name="op" value="remove_biblios" />
         <input type="hidden" name="referer" value="view" />
         <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]" />
@@ -317,6 +318,7 @@
 [% IF op == 'add_form' OR op == 'edit_form' %]
 
     <form method="post" action="/cgi-bin/koha/virtualshelves/shelves.pl" class="validated">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
 
         [% IF op == 'add_form' %]
@@ -450,6 +452,7 @@
     <div class="modal" id="addToList" tabindex="-1" role="dialog" aria-labelledby="addToListLabel">
         <div class="modal-dialog" role="document">
             <form action="/cgi-bin/koha/virtualshelves/shelves.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-content">
                     <div class="modal-header">
                         <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt
index 417411ab34..a563863a23 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt
@@ -38,6 +38,7 @@
     [%~ public      = public | html ~%]
     [%~ IF can_manage_shelf ~%]
         [%~ action_block =                '<form action="shelves.pl" method="get">' ~%]
+        [%~ action_block = action_block _ '[% INCLUDE 'csrf-token.inc' %]' ~%]
         [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber  _ '" />' ~%]
         [%~ action_block = action_block _ '<input type="hidden" name="op" value="edit_form" />' ~%]
         [%~ action_block = action_block _ '<input type="hidden" name="public" value="' _ public _ '" />' ~%]
@@ -47,6 +48,7 @@
     [%~ END ~%]
     [%~ IF can_manage_shelf OR can_delete_shelf ~%]
         [%~ action_block = action_block _ ' <form action="shelves.pl" method="post">' ~%]
+        [%~ action_block = action_block _ '[% INCLUDE 'csrf-token.inc' %]' ~%]
         [%~ action_block = action_block _ '<input type="hidden" name="shelves" value="1" />' ~%]
         [%~ action_block = action_block _ '<input type="hidden" name="op" value="delete" />' ~%]
         [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber  _ '" />' ~%]
diff --git a/virtualshelves/shelves.pl b/virtualshelves/shelves.pl
index a722326ad0..f4042d791e 100755
--- a/virtualshelves/shelves.pl
+++ b/virtualshelves/shelves.pl
@@ -29,7 +29,7 @@ use C4::Koha qw(
 );
 use C4::Items qw( GetItemsLocationInfo );
 use C4::Members;
-use C4::Output qw( pagination_bar output_html_with_http_headers );
+use C4::Output qw( pagination_bar output_html_with_http_headers output_and_exit_if_error );
 use C4::XSLT qw( XSLTParse4Display );
 
 use Koha::Biblios;
@@ -62,6 +62,7 @@ if ( $op eq 'add_form' ) {
     # Only pass default
     $shelf = { allow_change_from_owner => 1 };
 } elsif ( $op eq 'edit_form' ) {
+    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
     $shelfnumber = $query->param('shelfnumber');
     $shelf       = Koha::Virtualshelves->find($shelfnumber);
 
@@ -77,6 +78,7 @@ if ( $op eq 'add_form' ) {
         push @messages, { type => 'alert', code => 'does_not_exist' };
     }
 } elsif ( $op eq 'add' ) {
+    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
     my $allow_changes_from = $query->param('allow_changes_from');
     eval {
         $shelf = Koha::Virtualshelf->new(
@@ -102,6 +104,7 @@ if ( $op eq 'add_form' ) {
         $op = 'view';
     }
 } elsif ( $op eq 'edit' ) {
+    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
     $shelfnumber = $query->param('shelfnumber');
     $shelf       = Koha::Virtualshelves->find($shelfnumber);
 
@@ -132,6 +135,7 @@ if ( $op eq 'add_form' ) {
         push @messages, { type => 'alert', code => 'does_not_exist' };
     }
 } elsif ( $op eq 'delete' ) {
+    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
     $shelfnumber = $query->param('shelfnumber');
     $shelf       = Koha::Virtualshelves->find($shelfnumber);
     if ($shelf) {
@@ -150,6 +154,7 @@ if ( $op eq 'add_form' ) {
     }
     $op = 'list';
 } elsif ( $op eq 'add_biblio' ) {
+    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
     $shelfnumber = $query->param('shelfnumber');
     $shelf = Koha::Virtualshelves->find($shelfnumber);
     if ($shelf) {
@@ -206,6 +211,7 @@ if ( $op eq 'add_form' ) {
     }
     $op = $referer;
 } elsif ( $op eq 'remove_biblios' ) {
+    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
     $shelfnumber = $query->param('shelfnumber');
     $shelf = Koha::Virtualshelves->find($shelfnumber);
     my @biblionumbers = $query->multi_param('biblionumber');
-- 
2.20.1