From 188bad041171d6a690800f6a3166d571d5a83dca Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <phil@chetcolibrary.org>
Date: Thu, 31 Oct 2024 19:44:35 -0700
Subject: [PATCH] Bug 38309: Cannot delete additional fields

Deleting an additional field tries to do a GET of ?op=delete... which no
longer works with CSRF protection. It needs to be a POST with op=cud-delete.

Test plan:
 1. Administration - Additional fields, click any table name
 2. New field, fill in a name and Save
 3. In the row for your field, click Delete
 4. You have a blank page
 5. Apply patch, click the browser Back button, refresh the page
 6. In the row for your undeleted field, click Delete
 7. Your field is deleted

Sponsored-by: Chetco Community Public Library
Signed-off-by: David Nind <david@davidnind.com>
---
 .../prog/en/modules/admin/additional-fields.tt            | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt
index ed1c4af13e..02c7ab20e1 100755
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt
@@ -1,5 +1,6 @@
 [% USE AuthorisedValues %]
 [% USE raw %]
+[% USE Asset %]
 [% PROCESS 'i18n.inc' %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -187,7 +188,7 @@
                                     </td>
                                 <td class="actions">
                                     <a class="btn btn-default btn-xs" href="?op=add_form&amp;field_id=[% field.id | html %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a>
-                                    <a class="confirmdelete btn btn-default btn-xs" href="?op=delete&amp;field_id=[% field.id | uri %]&amp;tablename=[% tablename | uri %]"><i class="fa fa-trash-can"></i> Delete</a>
+                                    <a class="submit-form-link btn btn-default btn-xs" href="#" data-action="additional-fields.pl" data-method="post" data-op="cud-delete" data-field_id="[% field.id | html %]" data-tablename="[% tablename | html %]" data-confirmation-msg="[% t('Are you sure you want to delete this field?') | html %]"><i class="fa fa-trash-can"></i> Delete</a>
                                 </td>
                             </tr>
                         [% END %]
@@ -287,6 +288,7 @@
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE "datatables.inc" %]
+    [% Asset.js("js/form-submit.js") | $raw %]
     <script>
         $(document).ready(function(){
             $('#selecttable').find(":submit").hide();
@@ -303,10 +305,6 @@
                 "order": [[ 0, "asc" ]],
             }));
 
-            $(".confirmdelete").click(function(){
-                return confirm(_("Are you sure you want to delete this field?"));
-            });
-
             $("#add_field").on('submit', function() {
                 if ( $("#marcfield").length && $("select[name='authorised_value_category']").length ) {
                     if ( $("#marcfield").val().length > 0
-- 
2.39.5