From a40c876563a9e988a494ddc9d21a42e0e87208b0 Mon Sep 17 00:00:00 2001 From: Owen Leonard Date: Wed, 4 Jun 2025 11:04:01 +0000 Subject: [PATCH] Bug 40061: Add CSRF protection to patron image deletion The patron image deletion operation was not fully updated in Bug 34478. The individual "Delete" buttons in the table of images need to be updated to use form-submit.js Unrelated: I removed an invalid "align" attribute from a . To test, apply the patch and go to Tools -> Patron card creator -> Image manager. - Upload multiple images - Test the individual "Delete" buttons in the table of images. - Test that both the "OK" and "Cancel" operations work correctly. - Test the process of checking one or more checkboxes and clicking the "Delete selected" button. - Test that both the "OK" and "Cancel" operations work correctly. Sponsored-by: Athens County Public Libraries --- .../en/modules/patroncards/image-manage.tt | 31 ++++++------------- 1 file changed, 9 insertions(+), 22 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt index 3206ee48a84..c7b9d207e32 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt @@ -105,13 +105,18 @@ [% IF ( text_field.select_field ) %] Delete + Delete + - + [% ELSIF ( text_field.field_value ) %] [% text_field.field_value | html %] [% ELSE %] @@ -186,24 +191,6 @@ $("#delete").click(function () { return DeleteConfirm(); }); - $(".delete_image").on("click", function (ev) { - ev.preventDefault(); - const this_image = ev.target; - const image_id = this_image.dataset.image_id; - for (i = 0; i < document.delete_images.image_id.length; i++) { - const row_image_id = document.delete_images.image_id[i].value; - const row_checkbox = document.querySelector(`#image_id_${row_image_id}`); - if (image_id === row_image_id) { - row_checkbox.checked = true; - } else { - row_checkbox.checked = false; - } - } - const confirmed = confirmDelete(_("Are you sure you want to delete image: %s?").format(image_id)); - if (confirmed) { - document.delete_images.submit(); - } - }); }); [% END %] -- 2.39.5