Bugzilla – Attachment 156801 Details for
Bug 35019
Can't delete news from the staff interface main page
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 35019: Add a CSRF token when deleting news
Bug-35019-Add-a-CSRF-token-when-deleting-news.patch (text/plain), 2.89 KB, created by
Emily-Rose Francoeur
on 2023-10-10 17:26:38 UTC
(
hide
)
Description:
Bug 35019: Add a CSRF token when deleting news
Filename:
MIME Type:
Creator:
Emily-Rose Francoeur
Created:
2023-10-10 17:26:38 UTC
Size:
2.89 KB
patch
obsolete
>From a0b249d392d6cce7506bf62ac19ae52eaa2e69ad Mon Sep 17 00:00:00 2001 >From: Emily-Rose Francoeur <emily-rose.francoeur@inLibro.com> >Date: Tue, 10 Oct 2023 13:23:51 -0400 >Subject: [PATCH] Bug 35019: Add a CSRF token when deleting news >MIME-Version: 1.0 >Content-Type: text/plain; charset=UTF-8 >Content-Transfer-Encoding: 8bit > >I add a CSRF token as a parameter in the link for deleting a news entry, which solves the problem. > >TEST PLAN >1) Apply the patch >2) Go to âTools > News > New entryâ >3) âDisplay locationâ should be set to âStaff interfaceâ >4) Fill in the fields >5) Return to the homepage >6) Delete the created news entry >7) The âAdditional contentsâ page is displayed, and the deleted news entry no longer appears >8) Return to the homepage; the news entry no longer displays >--- > koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt | 2 +- > mainpage.pl | 2 ++ > 2 files changed, 3 insertions(+), 1 deletion(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt >index 1b4dfe93dd..6beb0aca28 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt >@@ -34,7 +34,7 @@ > <p class="newsfooter"> Posted on [% koha_new.published_on | $KohaDates %][% IF( show_author && koha_new.author ) %] by <span class="newsauthor">[% INCLUDE 'patron-title.inc' patron=koha_new.author %]<br />[% END %] > [% IF ( CAN_user_tools_edit_additional_contents ) %] > <a href="/cgi-bin/koha/tools/additional-contents.pl?op=add_form&id=[% koha_new.idnew | uri %]">Edit</a> >- | <a class="news_delete" href="/cgi-bin/koha/tools/additional-contents.pl?op=delete_confirmed&ids=[% koha_new.idnew | html %]">Delete</a> >+ | <a class="news_delete" href="/cgi-bin/koha/tools/additional-contents.pl?op=delete_confirmed&ids=[% koha_new.idnew | html %]&csrf_token=[% csrf_token | uri %]">Delete</a> > | <a href="/cgi-bin/koha/tools/additional-contents.pl?op=add_form">New</a> > [% END %] > </p> >diff --git a/mainpage.pl b/mainpage.pl >index 855913ae72..4dac7fb41d 100755 >--- a/mainpage.pl >+++ b/mainpage.pl >@@ -37,6 +37,7 @@ use Koha::Suggestions; > use Koha::BackgroundJobs; > use Koha::CurbsidePickups; > use Koha::Tickets; >+use Koha::Token; > > my $query = CGI->new; > >@@ -69,6 +70,7 @@ my $koha_news = Koha::AdditionalContents->search_for_display( > > $template->param( > koha_news => $koha_news, >+ csrf_token => Koha::Token->new->generate_csrf({ session_id => $query->cookie('CGISESSID'), }), > daily_quote => Koha::Quotes->get_daily_quote(), > ); > >-- >2.34.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 35019
:
156801
|
156802
|
156822
|
157215