From fc71d34c28fc6e19f563cd5e388cfde520cbd38b Mon Sep 17 00:00:00 2001 From: Julian Maurice Date: Wed, 2 Apr 2025 15:06:35 +0200 Subject: [PATCH] Bug 39527: Add action attribute to letter.pl form MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If not explicitly set, two 'op' parameters are sent, one with the value in the URL (add_form), one with the value in the form (cud-add_validate). This causes an error in the CSRF validation code under Mojolicious environment. Test plan: 1. Start staff interface as mojolicious application: `bin/intranet daemon -l http://*:3000/` 2. Go to http://localhost:3000 (replace localhost by the hostname where koha is running), log in, then go to Tools ยป Notices and slips. 3. Create a new notice. Without the patch it fails with the following message: Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-" With the patch it should succeed. --- koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt index 2bc37a1264..9d5b4495aa 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt @@ -366,7 +366,7 @@ -
+ [% INCLUDE 'csrf-token.inc' %] [% IF add_form %] -- 2.39.5