Attachment 174434 Details for Bug 38378 – Bug 38378: Serial frequency deletion needs to be converted to POST from GET

[patch] Bug 38378: Serial frequency deletion needs to be converted to POST from GET

Bug-38378-Serial-frequency-deletion-needs-to-be-co.patch (text/plain), 2.99 KB, created by Brendan Lawlor on 2024-11-12 17:52:57 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Brendan Lawlor

Created: 2024-11-12 17:52:57 UTC

Size: 2.99 KB

patch

obsolete

>From f1d297a67f43a09589214d9e94816a5b1e59ba52 Mon Sep 17 00:00:00 2001
>From: Phil Ringnalda <phil@chetcolibrary.org>
>Date: Fri, 8 Nov 2024 14:08:18 -0800
>Subject: [PATCH] Bug 38378: Serial frequency deletion needs to be converted to
> POST from GET
>
>Deleting a serial frequency is (or can be) a two step process. If you are
>deleting a frequency which is in use, you get back a page warning you that it
>is in use, which the CSRF changes converted to a form POSTing with a CSRF
>token and the new op cud-del. However, to get there you have to go through
>the step that's the only step if the frequency isn't in use, clicking a link
>that still thinks the op is named del rather than cud-del. That link needs to
>instead be a form with a CSRF token and a POST of cud-del.
>
>Test plan:
> 1. Without the patch, Serials - Manage frequencies
> 2. For any frequency, click Delete, click OK in the confirmation popup
> 3. Nothing happened except your URL changing, the frequency is still there
> 4. Apply patch, reload Manage frequencies
> 5. For any frequency, click Delete, click OK in the confirmation popup
> 6. This time, your frequency was deleted
>
>Sponsored-by: Chetco Community Public Library
>Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
>---
> .../prog/en/modules/serials/subscription-frequencies.tt    | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt
>index ed4b28816a..037d8cbcc7 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt
>@@ -184,7 +184,12 @@
>                                 <td>[% frequency.displayorder | html %]</td>
>                                 <td class="actions">
>                                     <a class="btn btn-default btn-xs" href="/cgi-bin/koha/serials/subscription-frequencies.pl?op=modify&frequencyid=[% frequency.id | html %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a>
>-                                    <a class="delete_frequency btn btn-default btn-xs" href="/cgi-bin/koha/serials/subscription-frequencies.pl?op=del&frequencyid=[% frequency.id | html %]"><i class="fa fa-trash-can"></i> Delete</a>
>+                                    <form action="/cgi-bin/koha/serials/subscription-frequencies.pl" method="post">
>+                                        [% INCLUDE 'csrf-token.inc' %]
>+                                        <input type="hidden" name="op" value="cud-del" />
>+                                        <input type="hidden" name="frequencyid" value="[% frequency.id | html %]" />
>+                                        <button class="delete_frequency btn btn-default btn-xs"><i class="fa fa-trash-can"></i> Delete</button>
>+                                    </form>
>                                 </td>
>                             </tr>
>                         [% END %]
>-- 
>2.39.5

Actions: View | Diff | Splinter Review

Attachments on bug 38378: 174076 | 174077 | 174195 | 174231 | 174309 | 174434 | 174444