From 3ad6e592307da5ec63bb4ddc04dbd81490718ef1 Mon Sep 17 00:00:00 2001 From: Phil Ringnalda Date: Fri, 8 Nov 2024 16:53:23 -0800 Subject: [PATCH] Bug 38413: Batch operations from item search need to POST to not exceed URL length limits Batch item modification and deletion accepts either op="show" or op="cud-show" because sometimes you just have one item and it's saner to GET with one, but sometimes you've selected 961 items from itemsearch and you need to POST to not get hit by Apache's "too long" error. Bug 36630 switched item search from using POST to GET because item search is confusing. It uses a form with a dummy op and then empties out the form and adds back contents, and the CSRF protection changed the dummy op to "cud-show" so it could POST, but didn't notice that the op would be replaced by one that was still "show." The form needs to go back to POST, the dummy contents need a comment saying they are just dummies so nobody else gets fooled, and the JS that replaces the form contents needs to insert a CSRF token and the correct op. Test plan: 1. Without the patch, Search - Item search, search with no criteria so you get hundreds of items 2. Change to Show All entries, then Select visible rows 3. Batch operations - Batch item modification 4. Apache should give you an error about your overly long URL 5. Apply patch and repeat steps 1-3 6. After a long pause while Batch item modification swallows the POST, you should get the batch modification form with all your items. Sponsored-by: Chetco Community Public Library --- .../prog/en/modules/catalogue/itemsearch.tt | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt index c02ba8d4cd..e7e70ee689 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt @@ -348,8 +348,10 @@ -
- + + + [% INCLUDE 'csrf-token.inc' %] +
@@ -782,7 +784,12 @@ batch_mod_form.append( $("").attr("type","hidden") .attr("name", "op") - .val("show") + .val("cud-show") + ); + batch_mod_form.append( + $("").attr("type","hidden") + .attr("name", "csrf_token") + .val($('meta[name="csrf-token"]').attr('content')) ); batch_mod_form.append( $("").attr("type","hidden") -- 2.44.0