From 4e2072e11351897a7ff26f133fce0f1cd78fa57e Mon Sep 17 00:00:00 2001 From: Owen Leonard Date: Wed, 1 May 2024 11:04:41 +0000 Subject: [PATCH] Bug 36739: Correct CSRF change to budget deletions Content-Type: text/plain; charset=utf-8 This is another instance of the deletion confirmation step getting mistakenly auto-updated as if it were the deletion step. The 'delete_confirm' doesn't need the 'cud-' prefix, only the 'delete_confirmed' step. To test, apply the patch and restart services. - Test the process of deleting a budget. - On the confirmation step you should see the name of the budget you're about to delete. - After confirming, the deletion should complete correctly. Signed-off-by: Caroline Cyr La Rose Signed-off-by: Marcel de Rooy --- admin/aqbudgetperiods.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/admin/aqbudgetperiods.pl b/admin/aqbudgetperiods.pl index 35a5522ac2..c66969a21c 100755 --- a/admin/aqbudgetperiods.pl +++ b/admin/aqbudgetperiods.pl @@ -145,7 +145,7 @@ elsif ( $op eq 'cud-add_validate' ) { } #-------------------------------------------------- -elsif ( $op eq 'cud-delete_confirm' ) { +elsif ( $op eq 'delete_confirm' ) { ## delete a budget period (preparation) my $funds = GetBudgets({ budget_period_id => $budget_period_id }); my $fund_count = scalar @$funds; -- 2.30.2