From f1fc5281219c0a991ae6a532e485d762e6442187 Mon Sep 17 00:00:00 2001 From: Baptiste Wojtkowski Date: Wed, 12 Mar 2025 14:42:42 +0100 Subject: [PATCH] Bug 39317: Fix CSRF protection for letters TEST PLAN: 1 - go to /cgi-bin/koha/tools/letter.pl 2 - click on New notice -> claim serial issue (or any other one) 3 - Fill required fields with random string 4 - Save -> if it breaks, go to 5 - Open a network panel (F12 -> network) 6 - Filter on letter.pl 7 - Fill another new notice -> the arguments of the form page have been passed in the address of the POST request. 8 - Apply patch 9 - Repeat the whole process and see it works now Signed-off-by: Magnus Enger I can't recreate the problem, but the change seems sensible enough and does not seem to introduce a regression, I can still save a new letter/notice. Signed-off-by: David Cook --- koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt index 2bc37a1264..f04b9e766d 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt @@ -366,7 +366,7 @@ -
+ [% INCLUDE 'csrf-token.inc' %] [% IF add_form %] -- 2.39.5