Attachment 170892 Details for Bug 37768 – Bug 37768: Fix form that POSTs without an op in itemtype administration

[patch] Bug 37768: Fix form that POSTs without an op in itemtype administration

Bug-37768-Fix-form-that-POSTs-without-an-op-in-ite.patch (text/plain), 2.51 KB, created by Phil Ringnalda on 2024-08-29 23:27:38 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Phil Ringnalda

Created: 2024-08-29 23:27:38 UTC

Size: 2.51 KB

patch

obsolete

>From 67af1bc0e499c47e332dad2a3edd7872892d644c Mon Sep 17 00:00:00 2001
>From: Phil Ringnalda <phil@chetcolibrary.org>
>Date: Thu, 29 Aug 2024 16:18:52 -0700
>Subject: [PATCH] Bug 37768: Fix form that POSTs without an op in itemtype
> administration
>
>We intend not to have forms with method="post" without an op variable (so we
>can check that the op starts with "cud-" as part of the CSRF protection), but
>because of bug 37728 some were missed.
>
>For itemtype administration, that's the "No, do not delete" cancel button
>when you decide not to delete an itemtype, which doesn't need to POST
>anything since it's just taking you back to the list of itemtypes. The only
>visible change from switching to a GET is that the URL ends with a "?" from
>a GET with no params, but someone can fix that by choosing one of our various
>link-as-a-cancel-button styles and switching it to a link in a bug that
>doesn't block an RM_priority bug.
>
>Test plan:
>1. You aren't going to see a visible difference, so start with the patch
>   applied
>2. Administration - Item types
>3. You need an itemtype that isn't in use to be able to delete it - ktd
>   provides you with an unused Computer Files type, so click the Delete
>   button for that row
>4. In the "Are you sure..." page, click No, do not delete
>5. Verify that you are back at the list of itemtypes, with only the "?" at
>   the end of the URL to tell you that you did a GET rather than a POST
>
>Sponsored-by: Chetco Community Public Library
>---
> koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt
>index 81f6c319dc..a4e68e69af 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt
>@@ -379,8 +379,7 @@
>             <input type="hidden" name="op" value="cud-delete_confirmed" /><input type="hidden" name="itemtype" value="[% itemtype.itemtype | html %]" />
>             <button type="submit" class="btn btn-default approve"><i class="fa fa-fw fa-check"></i> Yes, delete this item type</button>
>         </form>
>-        <form action="/cgi-bin/koha/admin/itemtypes.pl" method="post">
>-            [% INCLUDE 'csrf-token.inc' %]
>+        <form action="/cgi-bin/koha/admin/itemtypes.pl" method="get">
>             <button type="submit" class="btn btn-default deny"><i class="fa fa-fw fa-times"></i> No, do not delete</button>
>         </form>
>     </div>
>-- 
>2.44.0

Actions: View | Diff | Splinter Review

Attachments on bug 37768: 170892 | 170958