From 7c81d4046785f8d58ba0bcf909fc1ae9012b76a5 Mon Sep 17 00:00:00 2001 From: Phil Ringnalda Date: Fri, 8 Nov 2024 16:53:23 -0800 Subject: [PATCH] Bug 38413: Batch operations from item search need to POST to not exceed URL length limits Batch item modification and deletion accepts either op="show" or op="cud-show" because sometimes you just have one item and it's saner to GET with one, but sometimes you've selected 961 items from itemsearch and you need to POST to not get hit by Apache's "too long" error. Bug 36630 switched item search from using POST to GET because item search is confusing. It uses a form with a dummy op and then empties out the form and adds back contents, and the CSRF protection changed the dummy op to "cud-show" so it could POST, but didn't notice that the op would be replaced by one that was still "show." The form needs to go back to POST, the dummy contents need a comment saying they are just dummies so nobody else gets fooled, and the JS that replaces the form contents needs to insert a CSRF token and the correct op. Test plan: 1. Without the patch, Search - Item search, search with no criteria so you get hundreds of items 2. Change to Show All entries, then Select visible rows 3. Batch operations - Batch item modification 4. Apache should give you an error about your overly long URL 5. Apply patch and repeat steps 1-3 6. After a long pause while Batch item modification swallows the POST, you should get the batch modification form with all your items. Sponsored-by: Chetco Community Public Library Signed-off-by: David Nind Signed-off-by: Emily Lamancusa --- .../prog/en/modules/catalogue/itemsearch.tt | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt index b9d1f42a4d..3dd1cc9bd5 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt @@ -349,8 +349,10 @@ -
- + + + [% INCLUDE 'csrf-token.inc' %] +
@@ -786,7 +788,12 @@ batch_mod_form.append( $("").attr("type","hidden") .attr("name", "op") - .val("show") + .val("cud-show") + ); + batch_mod_form.append( + $("").attr("type","hidden") + .attr("name", "csrf_token") + .val($('meta[name="csrf-token"]').attr('content')) ); batch_mod_form.append( $("").attr("type","hidden") -- 2.34.1