From c8a76174521e92d2872c2a053c720b9b6adb5a67 Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Wed, 30 Aug 2023 00:28:53 +0000
Subject: [PATCH] Bug 34650: Convert list toolbar delete into form POST

This patch adds a HTML form with a CSRF token to POST the list delete,
which is triggered by a click handler on the A element. The A element
is still needed for existing style reasons.

Test plan:
0. Apply patch
1. koha-plack --reload kohadev
2. In the staff interface, add a list
3. Go into that list (e.g. virtualshelves/shelves.pl?op=view&shelfnumber=X)
4. From the toolbar click the "Edit" dropdown
5. From the dropdown try either "Edit list" or "Delete list"
6. Note no CSRF error and operation completes as expected
---
 .../prog/en/includes/virtualshelves-toolbar.inc          | 9 ++++++++-
 .../prog/en/modules/virtualshelves/shelves.tt            | 8 ++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc
index 1bafe9d1c6..c00b73d7c2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc
@@ -17,7 +17,14 @@
             <button class="btn btn-default dropdown-toggle" data-toggle="dropdown"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit <span class="caret"></span></button>
             <ul class="dropdown-menu">
                 <li><a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=edit_form&amp;shelfnumber=[% shelf.shelfnumber | uri %]&amp;referer=[% op | uri %]">Edit list</a></li>
-                <li><a id="deleteshelf" href="/cgi-bin/koha/virtualshelves/shelves.pl?op=delete&amp;shelfnumber=[% shelf.shelfnumber | html %]">Delete list</a></li>
+                <li>
+                    <a id="deleteshelf_toolbar" href="#">Delete list</a>
+                    <form id="deleteshelf_toolbar_form" action="shelves.pl" method="post">
+                        [% INCLUDE 'csrf-token.inc' %]
+                        <input type="hidden" name="op" value="delete">
+                        <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]">
+                    </form>
+                </li>
             </ul>
         </div>
         [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
index 9882e5cecf..ee7b98290c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
@@ -957,6 +957,14 @@
                         e.preventDefault();
                     }
                 });
+                $("#deleteshelf_toolbar").on('click',function(e){
+                    if(confirm(_("Are you sure you want to delete this list?"))){
+                        $("#deleteshelf_toolbar_form").submit();
+                        return false;
+                    } else {
+                        e.preventDefault();
+                    }
+                });
              });
 
         [% END %]
-- 
2.30.2