Bugzilla – Attachment 170953 Details for
Bug 31632
Add ability to manually link orders to suggestions
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 31632: (follow-up) CSRF protection for linking order to suggestion
Bug-31632-follow-up-CSRF-protection-for-linking-or.patch (text/plain), 4.78 KB, created by
Aleisha Amohia
on 2024-09-02 23:55:56 UTC
(
hide
)
Description:
Bug 31632: (follow-up) CSRF protection for linking order to suggestion
Filename:
MIME Type:
Creator:
Aleisha Amohia
Created:
2024-09-02 23:55:56 UTC
Size:
4.78 KB
patch
obsolete
>From 4c0de7747b32ab6ffcc1e7f583f882ec87ad3e44 Mon Sep 17 00:00:00 2001 >From: Aleisha Amohia <aleishaamohia@hotmail.com> >Date: Mon, 2 Sep 2024 23:55:00 +0000 >Subject: [PATCH] Bug 31632: (follow-up) CSRF protection for linking order to > suggestion > >--- > acqui/newordersuggestion.pl | 2 +- > koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt | 3 ++- > .../intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt | 3 ++- > 3 files changed, 5 insertions(+), 3 deletions(-) > >diff --git a/acqui/newordersuggestion.pl b/acqui/newordersuggestion.pl >index fec5a2ef10f..3c467892f75 100755 >--- a/acqui/newordersuggestion.pl >+++ b/acqui/newordersuggestion.pl >@@ -129,7 +129,7 @@ if ( $op eq 'connectDuplicate' ) { > ConnectSuggestionAndBiblio( $suggestionid, $duplicateNumber ); > } > >-if ( $op eq 'link_order' and $link_order ) { >+if ( $op eq 'cud-link_order' and $link_order ) { > my $order = Koha::Acquisition::Orders->find($link_order); > my $suggestion = Koha::Suggestions->find($suggestionid); > $suggestion->update( { biblionumber => $order->biblionumber } ) if $order->biblionumber; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt >index d9c32b2cf1b..26cf15d05f7 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt >@@ -726,7 +726,7 @@ > <br /> > [% END %] > [% UNLESS ( books_loo.suggestionid ) %] >- <a href="/cgi-bin/koha/acqui/newordersuggestion.pl?booksellerid=[% booksellerid | uri %]&basketno=[% basketno | uri %]&link_order=[% books_loo.ordernumber | uri %]">[% tp('verb', 'Link suggestion') | html %]</a> >+ <a data-action="/cgi-bin/koha/acqui/newordersuggestion.pl" data-booksellerid="[% booksellerid | uri %]" data-basketno="[% basketno | uri %]" data-link_order="[% books_loo.ordernumber | uri %]" data-method="post" class="submit-form-link" href="#">[% tp('verb', 'Link suggestion') | html %]</a> > [% END %] > </td> > [% END %] >@@ -1015,6 +1015,7 @@ > [% INCLUDE 'columns_settings.inc' %] > [% Asset.js("lib/hc-sticky/hc-sticky.js") | $raw %] > [% Asset.js("js/acq.js") | $raw %] >+ [% Asset.js("js/form-submit.js") | $raw %] > [% INCLUDE 'calendar.inc' %] > <script> > function updateColumnsVisibility(visible) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt >index 226794e2361..0325064bc27 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt >@@ -101,7 +101,7 @@ > </td> > <td class="actions"> > [% IF link_order %] >- <a href="/cgi-bin/koha/acqui/newordersuggestion.pl?op=link_order&link_order=[% link_order | uri %]&booksellerid=[% booksellerid | uri %]&basketno=[% basketno | uri %]&suggestionid=[% suggestion.suggestionid | uri %]" class="btn btn-default btn-xs"><i class="fa fa-plus"></i> [% tp('verb', 'Link suggestion') | html %]</a> >+ <a data-action="/cgi-bin/koha/acqui/newordersuggestion.pl" data-op="cud-link_order" data-link_order="[% link_order | uri %]" data-booksellerid="[% booksellerid | uri %]" data-basketno="[% basketno | uri %]" data-suggestionid="[% suggestion.suggestionid | uri %]" data-method="post" class="btn btn-default btn-xs submit-form-link" href="#"><i class="fa fa-plus"></i> [% tp('verb', 'Link suggestion') | html %]</a> > [% ELSIF ( suggestion.biblionumber ) %] > <a href="neworderempty.pl?booksellerid=[% booksellerid | uri %]&basketno=[% basketno | uri %]&suggestionid=[% suggestion.suggestionid | uri %]&biblio=[% suggestion.biblionumber | uri %]" class="btn btn-default btn-xs"><i class="fa fa-plus"></i> [% tp('verb', 'Order') | html %]</a> > [% ELSE %] >@@ -128,6 +128,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/acquisitions-menu.js") | $raw %] >+ [% Asset.js("js/form-submit.js") | $raw %] > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'calendar.inc' %] > <script> >-- >2.39.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 31632
:
141028
|
141029
|
141030
|
169391
|
170147
|
170148
| 170953