From f1d297a67f43a09589214d9e94816a5b1e59ba52 Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <phil@chetcolibrary.org>
Date: Fri, 8 Nov 2024 14:08:18 -0800
Subject: [PATCH] Bug 38378: Serial frequency deletion needs to be converted to
 POST from GET

Deleting a serial frequency is (or can be) a two step process. If you are
deleting a frequency which is in use, you get back a page warning you that it
is in use, which the CSRF changes converted to a form POSTing with a CSRF
token and the new op cud-del. However, to get there you have to go through
the step that's the only step if the frequency isn't in use, clicking a link
that still thinks the op is named del rather than cud-del. That link needs to
instead be a form with a CSRF token and a POST of cud-del.

Test plan:
 1. Without the patch, Serials - Manage frequencies
 2. For any frequency, click Delete, click OK in the confirmation popup
 3. Nothing happened except your URL changing, the frequency is still there
 4. Apply patch, reload Manage frequencies
 5. For any frequency, click Delete, click OK in the confirmation popup
 6. This time, your frequency was deleted

Sponsored-by: Chetco Community Public Library
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
---
 .../prog/en/modules/serials/subscription-frequencies.tt    | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt
index ed4b28816a..037d8cbcc7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt
@@ -184,7 +184,12 @@
                                 <td>[% frequency.displayorder | html %]</td>
                                 <td class="actions">
                                     <a class="btn btn-default btn-xs" href="/cgi-bin/koha/serials/subscription-frequencies.pl?op=modify&frequencyid=[% frequency.id | html %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a>
-                                    <a class="delete_frequency btn btn-default btn-xs" href="/cgi-bin/koha/serials/subscription-frequencies.pl?op=del&frequencyid=[% frequency.id | html %]"><i class="fa fa-trash-can"></i> Delete</a>
+                                    <form action="/cgi-bin/koha/serials/subscription-frequencies.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
+                                        <input type="hidden" name="op" value="cud-del" />
+                                        <input type="hidden" name="frequencyid" value="[% frequency.id | html %]" />
+                                        <button class="delete_frequency btn btn-default btn-xs"><i class="fa fa-trash-can"></i> Delete</button>
+                                    </form>
                                 </td>
                             </tr>
                         [% END %]
-- 
2.39.5