From 9bc64f22afdaa8a11c79e00f14fe823cff4a624e Mon Sep 17 00:00:00 2001 From: David Cook Date: Tue, 22 Oct 2024 00:42:22 +0000 Subject: [PATCH] Bug 38030: (QA follow-up) Move csrf_token to POST body from URL Signed-off-by: David Cook --- cataloguing/value_builder/stocknumberAV.pl | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/cataloguing/value_builder/stocknumberAV.pl b/cataloguing/value_builder/stocknumberAV.pl index 92e6e59dc0..dedef7968a 100755 --- a/cataloguing/value_builder/stocknumberAV.pl +++ b/cataloguing/value_builder/stocknumberAV.pl @@ -50,13 +50,14 @@ my $builder = sub { function Click$params->{id}(ev) { ev.preventDefault(); var code = document.getElementById(ev.data.id); - const token = document.getElementsByName('csrf_token')[0].value; + const csrf_token = document.querySelector('meta[name="csrf-token"]').getAttribute('content'); \$.ajax({ - url: '/cgi-bin/koha/cataloguing/plugin_launcher.pl?csrf_token=' + token, + url: '/cgi-bin/koha/cataloguing/plugin_launcher.pl', type: 'POST', data: { 'plugin_name': 'stocknumberAV.pl', 'code' : code.value, + 'csrf_token': csrf_token }, success: function(data){ var field = document.getElementById(ev.data.id); -- 2.39.2