From cdcf3ea66a8a0b91e0845f119d173a61ce94d175 Mon Sep 17 00:00:00 2001 From: Owen Leonard Date: Wed, 12 Jun 2024 17:49:25 +0000 Subject: [PATCH] Bug 37074: Comment approval and un-approval should be CSRF-protected This patch converts the "Approve" and "Unapprove" controls in the staff client's comment moderation page so that the operations are POST instead of GET. To test, apply the patch and restart services. - If necessary, enable OPACComments and submit a few comments on a few titles in the OPAC - Go to Tools -> Comments - Test the process of approving, unapproving, and deleting comments Signed-off-by: Lucas Gass --- .../prog/en/modules/reviews/reviewswaiting.tt | 19 ++++++++++++++++++- reviews/reviewswaiting.pl | 4 ++-- 2 files changed, 20 insertions(+), 3 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reviews/reviewswaiting.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reviews/reviewswaiting.tt index 536ab93cc2..ef991d33c7 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/reviews/reviewswaiting.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reviews/reviewswaiting.tt @@ -97,10 +97,27 @@ [% review.review | html %] - [% IF ( status ) %] Unapprove[% ELSE %] Approve[% END %] + [% IF ( review.approved ) %] +
+ [% INCLUDE 'csrf-token.inc' %] + + + + +
+ [% ELSE %] +
+ [% INCLUDE 'csrf-token.inc' %] + + + + +
+ [% END %]
[% INCLUDE 'csrf-token.inc' %] +
diff --git a/reviews/reviewswaiting.pl b/reviews/reviewswaiting.pl index f6bd5ff29d..b17dc8b9e1 100755 --- a/reviews/reviewswaiting.pl +++ b/reviews/reviewswaiting.pl @@ -42,11 +42,11 @@ my $page = $query->param('page') || 1; my $count = C4::Context->preference('numSearchResults') || 20; my $total = Koha::Reviews->search_limited({ approved => $status })->count; -if ( $op eq 'approve' ) { +if ( $op eq 'cud-approve' ) { my $review = Koha::Reviews->find( $reviewid ); $review->approve if $review; } -elsif ( $op eq 'unapprove' ) { +elsif ( $op eq 'cud-unapprove' ) { my $review = Koha::Reviews->find( $reviewid ); $review->unapprove if $review; } -- 2.39.2