From e95c099b9e38adbe5c008336f8e2e5b6a5e8dfec Mon Sep 17 00:00:00 2001 From: Owen Leonard Date: Wed, 4 Jun 2025 11:04:01 +0000 Subject: [PATCH] Bug 40061: Add CSRF protection to patron image deletion Content-Type: text/plain; charset=utf-8 The patron image deletion operation was not fully updated in Bug 34478. The individual "Delete" buttons in the table of images need to be updated to use form-submit.js Unrelated: I removed an invalid "align" attribute from a . To test, apply the patch and go to Tools -> Patron card creator -> Image manager. - Upload multiple images - Test the individual "Delete" buttons in the table of images. - Test that both the "OK" and "Cancel" operations work correctly. - Test the process of checking one or more checkboxes and clicking the "Delete selected" button. - Test that both the "OK" and "Cancel" operations work correctly. Sponsored-by: Athens County Public Libraries Signed-off-by: Caroline Cyr La Rose Signed-off-by: Marcel de Rooy --- .../en/modules/patroncards/image-manage.tt | 31 ++++++------------- 1 file changed, 9 insertions(+), 22 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt index 3206ee48a8..c7b9d207e3 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt @@ -105,13 +105,18 @@ [% IF ( text_field.select_field ) %] Delete + Delete + - + [% ELSIF ( text_field.field_value ) %] [% text_field.field_value | html %] [% ELSE %] @@ -186,24 +191,6 @@ $("#delete").click(function () { return DeleteConfirm(); }); - $(".delete_image").on("click", function (ev) { - ev.preventDefault(); - const this_image = ev.target; - const image_id = this_image.dataset.image_id; - for (i = 0; i < document.delete_images.image_id.length; i++) { - const row_image_id = document.delete_images.image_id[i].value; - const row_checkbox = document.querySelector(`#image_id_${row_image_id}`); - if (image_id === row_image_id) { - row_checkbox.checked = true; - } else { - row_checkbox.checked = false; - } - } - const confirmed = confirmDelete(_("Are you sure you want to delete image: %s?").format(image_id)); - if (confirmed) { - document.delete_images.submit(); - } - }); }); [% END %] -- 2.39.5