From bd710b5c940155c1c028fe73fbd146a912cc8fea Mon Sep 17 00:00:00 2001
From: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Date: Fri, 10 May 2024 15:09:21 +0000
Subject: [PATCH] Bug 19316: Add CSRF protection

Signed-off-by: baptiste <baptiste.bayche@inlibro.com>
---
 catalogue/updateitem.pl                                     | 4 ++--
 .../intranet-tmpl/prog/en/modules/catalogue/moredetail.tt   | 6 ++++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/catalogue/updateitem.pl b/catalogue/updateitem.pl
index 64bc6b2682..8718653b38 100755
--- a/catalogue/updateitem.pl
+++ b/catalogue/updateitem.pl
@@ -82,9 +82,9 @@ elsif ( $op eq "cud-set_public_note" ) { # i.e., itemnotes parameter passed from
     $item->bookable($bookable);
 } elsif ( $op eq "cud-set_damaged" && $damaged ne $item_data_hashref->{'damaged'}) {
     $item->damaged($damaged);
-} elsif ( $op eq "set_sort1" && $sort1 ne $item_data_hashref->{'sort1'} ) {
+} elsif ( $op eq "cud-set_sort1" && $sort1 ne $item_data_hashref->{'sort1'} ) {
     $item->sort1($sort1);
-} elsif ( $op eq "set_sort2" && $sort2 ne $item_data_hashref->{'sort2'} ) {
+} elsif ( $op eq "cud-set_sort2" && $sort2 ne $item_data_hashref->{'sort2'} ) {
     $item->sort2($sort2);
 } else {
     #nothings changed, so do nothing.
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt
index d5bb9586d4..f79d779e38 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt
@@ -387,8 +387,9 @@
                                             <span class="label">Sort 1:</span>
                                             [% IF ( CAN_user_editcatalogue_edit_items ) %]
                                                 <form class="inline" action="updateitem.pl" method="post"><input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
+                                                    [% INCLUDE 'csrf-token.inc' %]
                                                     <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" /><input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
-                                                    <input type="hidden" name="op" value="set_sort1" />
+                                                    <input type="hidden" name="op" value="cud-set_sort1" />
                                                     <textarea name="sort1" rows="2" cols="30">[% ITEM_DAT.sort1 | html %]</textarea><input type="submit" name="submit" class="btn btn-primary btn-xs" value="Update" />
                                                 </form>
                                             [% ELSE %]
@@ -399,8 +400,9 @@
                                             <span class="label">Sort 2:</span>
                                             [% IF ( CAN_user_editcatalogue_edit_items ) %]
                                                 <form class="inline" action="updateitem.pl" method="post"><input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
+                                                    [% INCLUDE 'csrf-token.inc' %]
                                                     <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" /><input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
-                                                    <input type="hidden" name="op" value="set_sort2" />
+                                                    <input type="hidden" name="op" value="cud-set_sort2" />
                                                     <textarea name="sort2" rows="2" cols="30">[% ITEM_DAT.sort2 | html %]</textarea><input type="submit" name="submit" class="btn btn-primary btn-xs" value="Update" />
                                                 </form>
                                             [% ELSE %]
-- 
2.34.1