From 84adfa1daf44ebfb8ee209517d940b1948bdb7c7 Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <phil@chetcolibrary.org>
Date: Fri, 1 Nov 2024 11:22:59 -0700
Subject: [PATCH] Bug 38328: Cannot delete ILL batch statuses

You are permitted to delete ILL batch statuses that you (rather than the
system) add, but the UI didn't get the CSRF memo about delete ops needing to
be POSTs with op="cud-delete", so it still uses a GET of ?op="delete" and
fails.

Test plan:
 1. Set the preference ILLModule to 'Enable'
 2. Administration - Interlibrary loan batch statuses - New batch status
 3. Give it a name, an uppercase code, and Save
 4. Click the Delete button to the right of your new status
 5. The page is blank, and if you navigate back to Interlibrary loan batch
    statuses, you'll see that yours was not deleted
 6. Apply patch, reload page
 7. Click the Delete button to the right of your new status, verify it is
    deleted

Sponsored-by: Chetco Community Public Library
---
 .../intranet-tmpl/prog/en/modules/admin/ill_batch_statuses.tt  | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/ill_batch_statuses.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/ill_batch_statuses.tt
index 12ea56085f..27c6d3392f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/ill_batch_statuses.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/ill_batch_statuses.tt
@@ -134,7 +134,7 @@
                                         <td class="actions">
                                             <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/ill_batch_statuses.pl?op=add_form&amp;code=[% status.code | uri %]"><i class="fa fa-pencil"></i> Edit</a>
                                             [% IF !status.is_system %]
-                                            <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/ill_batch_statuses.pl?op=delete&amp;code=[% status.code | uri %]"><i class="fa fa-delete"></i> Delete</a>
+                                            <a class="btn btn-default btn-xs submit-form-link" href="#" data-action="/cgi-bin/koha/admin/ill_batch_statuses.pl" data-method="post" data-op="cud-delete" data-code="[% status.code | html %]"><i class="fa fa-delete"></i> Delete</a>
                                             [% END %]
                                         </td>
                                     </tr>
@@ -160,6 +160,7 @@
 
 [% MACRO jsinclude BLOCK %]
     [% Asset.js("js/admin-menu.js") | $raw %]
+    [% Asset.js("js/form-submit.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
 [% END %]
 
-- 
2.44.0