From 4c0de7747b32ab6ffcc1e7f583f882ec87ad3e44 Mon Sep 17 00:00:00 2001
From: Aleisha Amohia <aleishaamohia@hotmail.com>
Date: Mon, 2 Sep 2024 23:55:00 +0000
Subject: [PATCH] Bug 31632: (follow-up) CSRF protection for linking order to
 suggestion

---
 acqui/newordersuggestion.pl                                    | 2 +-
 koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt        | 3 ++-
 .../intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt  | 3 ++-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/acqui/newordersuggestion.pl b/acqui/newordersuggestion.pl
index fec5a2ef10f..3c467892f75 100755
--- a/acqui/newordersuggestion.pl
+++ b/acqui/newordersuggestion.pl
@@ -129,7 +129,7 @@ if ( $op eq 'connectDuplicate' ) {
     ConnectSuggestionAndBiblio( $suggestionid, $duplicateNumber );
 }
 
-if ( $op eq 'link_order' and $link_order ) {
+if ( $op eq 'cud-link_order' and $link_order ) {
     my $order      = Koha::Acquisition::Orders->find($link_order);
     my $suggestion = Koha::Suggestions->find($suggestionid);
     $suggestion->update( { biblionumber => $order->biblionumber } ) if $order->biblionumber;
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
index d9c32b2cf1b..26cf15d05f7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
@@ -726,7 +726,7 @@
                                                                     <br />
                                                                 [% END %]
                                                                 [% UNLESS ( books_loo.suggestionid ) %]
-                                                                    <a href="/cgi-bin/koha/acqui/newordersuggestion.pl?booksellerid=[% booksellerid | uri %]&amp;basketno=[% basketno | uri %]&amp;link_order=[% books_loo.ordernumber | uri %]">[% tp('verb', 'Link suggestion') | html %]</a>
+                                                                    <a data-action="/cgi-bin/koha/acqui/newordersuggestion.pl" data-booksellerid="[% booksellerid | uri %]" data-basketno="[% basketno | uri %]" data-link_order="[% books_loo.ordernumber | uri %]" data-method="post" class="submit-form-link" href="#">[% tp('verb', 'Link suggestion') | html %]</a>
                                                                 [% END %]
                                                             </td>
                                                         [% END %]
@@ -1015,6 +1015,7 @@
     [% INCLUDE 'columns_settings.inc' %]
     [% Asset.js("lib/hc-sticky/hc-sticky.js") | $raw %]
     [% Asset.js("js/acq.js") | $raw %]
+    [% Asset.js("js/form-submit.js") | $raw %]
     [% INCLUDE 'calendar.inc' %]
     <script>
         function updateColumnsVisibility(visible) {
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt
index 226794e2361..0325064bc27 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt
@@ -101,7 +101,7 @@
                             </td>
                             <td class="actions">
                                 [% IF link_order %]
-                                    <a href="/cgi-bin/koha/acqui/newordersuggestion.pl?op=link_order&amp;link_order=[% link_order | uri %]&amp;booksellerid=[% booksellerid | uri %]&amp;basketno=[% basketno | uri %]&amp;suggestionid=[% suggestion.suggestionid | uri %]" class="btn btn-default btn-xs"><i class="fa fa-plus"></i> [% tp('verb', 'Link suggestion') | html %]</a>
+                                    <a data-action="/cgi-bin/koha/acqui/newordersuggestion.pl" data-op="cud-link_order" data-link_order="[% link_order | uri %]" data-booksellerid="[% booksellerid | uri %]" data-basketno="[% basketno | uri %]" data-suggestionid="[% suggestion.suggestionid | uri %]" data-method="post" class="btn btn-default btn-xs submit-form-link" href="#"><i class="fa fa-plus"></i> [% tp('verb', 'Link suggestion') | html %]</a>
                                 [% ELSIF ( suggestion.biblionumber ) %]
                                     <a href="neworderempty.pl?booksellerid=[% booksellerid | uri %]&amp;basketno=[% basketno | uri %]&amp;suggestionid=[% suggestion.suggestionid | uri %]&amp;biblio=[% suggestion.biblionumber | uri %]" class="btn btn-default btn-xs"><i class="fa fa-plus"></i> [% tp('verb', 'Order') | html %]</a>
                                 [% ELSE %]
@@ -128,6 +128,7 @@
 
 [% MACRO jsinclude BLOCK %]
     [% Asset.js("js/acquisitions-menu.js") | $raw %]
+    [% Asset.js("js/form-submit.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     [% INCLUDE 'calendar.inc' %]
     <script>
-- 
2.39.2