From 2dfbc4fee77cec9ecafe03d890f5bfbc88115809 Mon Sep 17 00:00:00 2001
From: Nick Clemens <nick@bywatersolutions.com>
Date: Wed, 20 Mar 2024 14:14:31 +0000
Subject: [PATCH] Bug 36135: (follow-up) Adjust for CSRF

---
 .../prog/en/modules/tools/batch_modify_holds.tt            | 7 ++++---
 tools/batch_modify_holds.pl                                | 2 +-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_modify_holds.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_modify_holds.tt
index 7705c36beb1..6b961764984 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_modify_holds.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_modify_holds.tt
@@ -42,7 +42,7 @@
                     <h1>Batch modify holds</h1>
 
                     [% IF view == 'form' %]
-                        <form method="post" action="/cgi-bin/koha/tools/batch_modify_holds.pl" id="modify_holds_form">
+                        <form method="get" action="/cgi-bin/koha/tools/batch_modify_holds.pl" id="modify_holds_form">
                             <fieldset class="rows">
                                 <legend>Hold search criteria:</legend>
                                 <span class="hint">NOTE! Column patron_expiration_date is used as a main filter for expiration date field. Otherwise column expirationdate is used.</span>
@@ -106,6 +106,7 @@
                         </form> <!-- /#modify_holds_form -->
                     [% ELSIF view == 'list' %]
                         <form action="/cgi-bin/koha/tools/batch_modify_holds.pl" method="post" id="process">
+                            [% INCLUDE 'csrf-token.inc' %]
                         [% IF holds.count %]
                             <div class="page-section">
                                 <div class="btn-toolbar selections-toolbar">
@@ -189,7 +190,7 @@
                                 </tbody>
                             </table> <!-- /#hold_modifies -->
                             <fieldset class="action">
-                                <input type="hidden" name="op" value="modify"/>
+                                <input type="hidden" name="op" value="cud-modify"/>
                                 <input type="submit" class="btn btn-primary" value="Modify selected holds"/>
                                 <a class="cancel" href="/cgi-bin/koha/tools/batch_modify_holds.pl">Cancel</a>
                             </fieldset>
@@ -310,4 +311,4 @@
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' %]
diff --git a/tools/batch_modify_holds.pl b/tools/batch_modify_holds.pl
index ddc08e3adca..839f682ecac 100755
--- a/tools/batch_modify_holds.pl
+++ b/tools/batch_modify_holds.pl
@@ -124,7 +124,7 @@ elsif ( $op eq 'list' ) {
     );
 }
 
-if ( $op eq 'modify' ) {
+if ( $op eq 'cud-modify' ) {
 
     my $new_expiration_date = $input->param('new_expiration_date');
     my $new_pickup_loc      = $input->param('new_pickup_loc');
-- 
2.30.2