From bf34259c306a355ad5d3b06d93b65d46171eb9ae Mon Sep 17 00:00:00 2001 From: Owen Leonard Date: Wed, 12 Jun 2024 17:49:25 +0000 Subject: [PATCH] Bug 37074: Comment approval and un-approval should be CSRF-protected This patch converts the "Approve" and "Unapprove" controls in the staff client's comment moderation page so that the operations are POST instead of GET. To test, apply the patch and restart services. - If necessary, enable OPACComments and submit a few comments on a few titles in the OPAC - Go to Tools -> Comments - Test the process of approving, unapproving, and deleting comments Signed-off-by: Lucas Gass Signed-off-by: Jonathan Druart --- .../prog/en/modules/reviews/reviewswaiting.tt | 19 ++++++++++++++++++- reviews/reviewswaiting.pl | 4 ++-- 2 files changed, 20 insertions(+), 3 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reviews/reviewswaiting.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reviews/reviewswaiting.tt index 536ab93cc26..ef991d33c71 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/reviews/reviewswaiting.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reviews/reviewswaiting.tt @@ -97,10 +97,27 @@ [% review.review | html %] - [% IF ( status ) %] Unapprove[% ELSE %] Approve[% END %] + [% IF ( review.approved ) %] +
+ [% INCLUDE 'csrf-token.inc' %] + + + + +
+ [% ELSE %] +
+ [% INCLUDE 'csrf-token.inc' %] + + + + +
+ [% END %]
[% INCLUDE 'csrf-token.inc' %] +
diff --git a/reviews/reviewswaiting.pl b/reviews/reviewswaiting.pl index f6bd5ff29db..b17dc8b9e12 100755 --- a/reviews/reviewswaiting.pl +++ b/reviews/reviewswaiting.pl @@ -42,11 +42,11 @@ my $page = $query->param('page') || 1; my $count = C4::Context->preference('numSearchResults') || 20; my $total = Koha::Reviews->search_limited({ approved => $status })->count; -if ( $op eq 'approve' ) { +if ( $op eq 'cud-approve' ) { my $review = Koha::Reviews->find( $reviewid ); $review->approve if $review; } -elsif ( $op eq 'unapprove' ) { +elsif ( $op eq 'cud-unapprove' ) { my $review = Koha::Reviews->find( $reviewid ); $review->unapprove if $review; } -- 2.34.1