From 7e15caad339fdf1596d74e56b5905275598ba3aa Mon Sep 17 00:00:00 2001
From: Emily-Rose Francoeur <emily-rose.francoeur@inLibro.com>
Date: Tue, 10 Oct 2023 13:30:43 -0400
Subject: [PATCH] Bug 35019: Add a CSRF token when deleting news

I add a CSRF token as a parameter in the link for deleting a news entry, which solves the problem.

TEST PLAN
1) Apply the patch
2) Go to "Tools > News > New entry"
3) "Display location" should be set to "Staff interface"
4) Fill in the fields
5) Return to the homepage
6) Delete the created news entry
7) The "Additional contents" page is displayed, and the deleted news entry no longer appears
8) Return to the homepage; the news entry no longer displays
---
 koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt | 2 +-
 mainpage.pl                                              | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt
index 1b4dfe93dd..6beb0aca28 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt
@@ -34,7 +34,7 @@
                                 <p class="newsfooter"> Posted on [% koha_new.published_on | $KohaDates %][% IF( show_author && koha_new.author ) %] by <span class="newsauthor">[% INCLUDE 'patron-title.inc' patron=koha_new.author %]<br />[% END %]
                                     [% IF ( CAN_user_tools_edit_additional_contents ) %]
                                         <a href="/cgi-bin/koha/tools/additional-contents.pl?op=add_form&amp;id=[% koha_new.idnew | uri %]">Edit</a>
-                                         | <a class="news_delete" href="/cgi-bin/koha/tools/additional-contents.pl?op=delete_confirmed&amp;ids=[% koha_new.idnew | html %]">Delete</a>
+                                         | <a class="news_delete" href="/cgi-bin/koha/tools/additional-contents.pl?op=delete_confirmed&amp;ids=[% koha_new.idnew | html %]&amp;csrf_token=[% csrf_token | uri %]">Delete</a>
                                          | <a href="/cgi-bin/koha/tools/additional-contents.pl?op=add_form">New</a>
                                     [% END %]
                                 </p>
diff --git a/mainpage.pl b/mainpage.pl
index 855913ae72..4dac7fb41d 100755
--- a/mainpage.pl
+++ b/mainpage.pl
@@ -37,6 +37,7 @@ use Koha::Suggestions;
 use Koha::BackgroundJobs;
 use Koha::CurbsidePickups;
 use Koha::Tickets;
+use Koha::Token;
 
 my $query = CGI->new;
 
@@ -69,6 +70,7 @@ my $koha_news = Koha::AdditionalContents->search_for_display(
 
 $template->param(
     koha_news   => $koha_news,
+    csrf_token  => Koha::Token->new->generate_csrf({ session_id => $query->cookie('CGISESSID'), }),
     daily_quote => Koha::Quotes->get_daily_quote(),
 );
 
-- 
2.34.1