From a360275264edbd06545910e18802f27b816c47d2 Mon Sep 17 00:00:00 2001 From: Nick Clemens <nick@bywatersolutions.com> Date: Wed, 20 Mar 2024 14:14:31 +0000 Subject: [PATCH] Bug 36135: (follow-up) Adjust for CSRF Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> --- .../prog/en/modules/reports/guided_reports_start.tt | 2 +- .../prog/en/modules/tools/batch_modify_holds.tt | 7 ++++--- tools/batch_modify_holds.pl | 2 +- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt index 1685165548..a2e8add680 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt @@ -1018,7 +1018,7 @@ </textarea> </form> - <form method="POST" action="/cgi-bin/koha/tools/batch_modify_holds.pl" id="batch_modify_holds"> + <form method="get" action="/cgi-bin/koha/tools/batch_modify_holds.pl" id="batch_modify_holds"> <input type="hidden" name="op" value="list" /> [% FOREACH result IN results %] [% FOREACH cells IN result.cells %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_modify_holds.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_modify_holds.tt index 7705c36beb..6b96176498 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_modify_holds.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_modify_holds.tt @@ -42,7 +42,7 @@ <h1>Batch modify holds</h1> [% IF view == 'form' %] - <form method="post" action="/cgi-bin/koha/tools/batch_modify_holds.pl" id="modify_holds_form"> + <form method="get" action="/cgi-bin/koha/tools/batch_modify_holds.pl" id="modify_holds_form"> <fieldset class="rows"> <legend>Hold search criteria:</legend> <span class="hint">NOTE! Column patron_expiration_date is used as a main filter for expiration date field. Otherwise column expirationdate is used.</span> @@ -106,6 +106,7 @@ </form> <!-- /#modify_holds_form --> [% ELSIF view == 'list' %] <form action="/cgi-bin/koha/tools/batch_modify_holds.pl" method="post" id="process"> + [% INCLUDE 'csrf-token.inc' %] [% IF holds.count %] <div class="page-section"> <div class="btn-toolbar selections-toolbar"> @@ -189,7 +190,7 @@ </tbody> </table> <!-- /#hold_modifies --> <fieldset class="action"> - <input type="hidden" name="op" value="modify"/> + <input type="hidden" name="op" value="cud-modify"/> <input type="submit" class="btn btn-primary" value="Modify selected holds"/> <a class="cancel" href="/cgi-bin/koha/tools/batch_modify_holds.pl">Cancel</a> </fieldset> @@ -310,4 +311,4 @@ </script> [% END %] -[% INCLUDE 'intranet-bottom.inc' %] \ No newline at end of file +[% INCLUDE 'intranet-bottom.inc' %] diff --git a/tools/batch_modify_holds.pl b/tools/batch_modify_holds.pl index ddc08e3adc..839f682eca 100755 --- a/tools/batch_modify_holds.pl +++ b/tools/batch_modify_holds.pl @@ -124,7 +124,7 @@ elsif ( $op eq 'list' ) { ); } -if ( $op eq 'modify' ) { +if ( $op eq 'cud-modify' ) { my $new_expiration_date = $input->param('new_expiration_date'); my $new_pickup_loc = $input->param('new_pickup_loc'); -- 2.30.2