From fd6c5d2d15ab79908faed8f27c42788ca169a53c Mon Sep 17 00:00:00 2001 From: Fridolin Somers Date: Fri, 17 Oct 2025 11:44:30 +0200 Subject: [PATCH] Bug 41043: Use op 'add_form' and 'edit_form' in z3950 servers Since CSRF protection, 'op' arg for creating/editing an object uses add_form and edit_form. This is missing only in admin/z3950servers.pl This patch also removes TT variable add_form to avoid confusion Test plan : 1) Create a new z3950 server 2) Enter mandatory datas in form and save 3) Edit this server 4) Copy this server 5) Repeat 1 to 4 for a SRU server --- admin/z3950servers.pl | 9 ++++--- .../prog/en/modules/admin/z3950servers.tt | 26 +++++++++---------- 2 files changed, 18 insertions(+), 17 deletions(-) diff --git a/admin/z3950servers.pl b/admin/z3950servers.pl index 04d1f7310d..22f94145f5 100755 --- a/admin/z3950servers.pl +++ b/admin/z3950servers.pl @@ -89,12 +89,13 @@ if ( $op eq 'cud-delete_confirmed' && $id ) { # Now list multiple records, or edit one record my $data = []; -if ( $op eq 'add' || $op eq 'edit' ) { +if ( $op eq 'add_form' || $op eq 'edit_form' ) { $data = ServerSearch( $schema, $id, $searchfield ) if $searchfield || $id; - delete $data->[0]->{id} if @$data && $op eq 'add'; #cloning record + delete $data->[0]->{id} if @$data && $op eq 'add_form'; #cloning record $template->param( - add_form => 1, server => @$data ? $data->[0] : undef, - op => $op, type => $op eq 'add' ? lc $type : '' + server => @$data ? $data->[0] : undef, + op => $op, + type => ( $op eq 'add_form' ) ? lc $type : '' ); } else { $data = ServerSearch( $schema, $id, $searchfield ); diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt index ef73637f27..63549127fc 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt @@ -14,10 +14,10 @@ [% FILTER collapse %] - [% IF op == 'edit' %] + [% IF op == 'edit_form' %] [% tx("Modify {servertype} server '{servername}'", { servertype = servertype, servername = server.servername }) | html %] › - [% ELSIF op == 'add' %] + [% ELSIF op == 'add_form' %] [% tx("New {servertype} server", { servertype = servertype }) | html %] › [% ELSIF searchfield %] @@ -42,17 +42,17 @@ <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> [% END %] - [% IF op == 'edit' || op == 'add' || searchfield %] + [% IF op == 'edit_form' || op == 'add_form' || searchfield %] [% WRAPPER breadcrumb_item %] <a href="/cgi-bin/koha/admin/z3950servers.pl">Z39.50/SRU servers</a> [% END %] [% END %] - [% IF op == 'edit' %] + [% IF op == 'edit_form' %] [% WRAPPER breadcrumb_item bc_active= 1 %] [% tx("Modify {servertype} server '{servername}'", { servertype = servertype, servername = server.servername }) | html %] [% END %] - [% ELSIF op == 'add' %] + [% ELSIF op == 'add_form' %] [% WRAPPER breadcrumb_item bc_active= 1 %] [% tx("New {servertype} server", { servertype = servertype }) | html %] [% END %] @@ -80,10 +80,10 @@ <div class="alert alert-warning">Error: Server with ID [% msg_add | html %] not found</div> [% END %] - [% IF ( add_form ) %] + [% IF op == 'edit_form' || op == 'add_form' %] <form action="/cgi-bin/koha/admin/z3950servers.pl" name="Aform" method="post" id="serverentry"> [% INCLUDE 'csrf-token.inc' %] - [% IF op == 'edit' %] + [% IF op == 'edit_form' %] <h1>[% tx("Modify {servertype} server '{servername}'", { servertype = servertype, servername = server.servername }) | html %]</h1> <input type="hidden" name="id" value="[% server.id | html %]" /> [% ELSE %] @@ -207,8 +207,8 @@ [% IF op == 'list' %] <div id="toolbar" class="btn-toolbar"> - <a id="newserver" class="btn btn-default" href="/cgi-bin/koha/admin/z3950servers.pl?op=add&type=zed"><i class="fa fa-plus"></i> New Z39.50 server</a> - <a id="newserver" class="btn btn-default" href="/cgi-bin/koha/admin/z3950servers.pl?op=add&type=sru"><i class="fa fa-plus"></i> New SRU server</a> + <a id="newserver" class="btn btn-default" href="/cgi-bin/koha/admin/z3950servers.pl?op=add_form&type=zed"><i class="fa fa-plus"></i> New Z39.50 server</a> + <a id="newserver" class="btn btn-default" href="/cgi-bin/koha/admin/z3950servers.pl?op=add_form&type=sru"><i class="fa fa-plus"></i> New SRU server</a> </div> <h1>Z39.50/SRU servers</h1> [% IF searchfield %] @@ -226,7 +226,7 @@ <tbody> [% FOREACH loo IN loop %] <tr> - <td><a href="/cgi-bin/koha/admin/z3950servers.pl?op=edit&id=[% loo.id | uri %]">[% loo.servername | html %]</a></td + <td><a href="/cgi-bin/koha/admin/z3950servers.pl?op=edit_form&id=[% loo.id | uri %]">[% loo.servername | html %]</a></td ><td>[% loo.host | html %]:[% loo.port | html %]</td><td>[% loo.db | html %]</td><td>[% loo.userid | html %]</td><td>[% IF loo.password %]########[% END %]</td ><td>[% IF ( loo.checked ) %]Yes[% ELSE %]No[% END %]</td><td>[% loo.rank | html %]</td> <td>[% loo.syntax | html %]</td><td>[% loo.encoding | html %]</td><td>[% loo.timeout | html %]</td> <td @@ -242,10 +242,10 @@ <a class="btn btn-default btn-xs dropdown-toggle" id="reportactions[% savedreport.id | html %]" role="button" data-bs-toggle="dropdown" href="#"> Actions </a> <ul class="dropdown-menu" role="menu" aria-labelledby="reportactions[% savedreport.id | html %]"> <li - ><a class="dropdown-item" href="/cgi-bin/koha/admin/z3950servers.pl?op=edit&id=[% loo.id | uri %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a></li + ><a class="dropdown-item" href="/cgi-bin/koha/admin/z3950servers.pl?op=edit_form&id=[% loo.id | uri %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a></li > <li - ><a class="dropdown-item" href="/cgi-bin/koha/admin/z3950servers.pl?op=add&id=[% loo.id | uri %]"><i class="fa fa-copy"></i> Copy</a></li + ><a class="dropdown-item" href="/cgi-bin/koha/admin/z3950servers.pl?op=add_form&id=[% loo.id | uri %]"><i class="fa fa-copy"></i> Copy</a></li > <li> <a href="#" class="dropdown-item delete" data-formid="server_row_[% loo.id | uri %]" data-servername="[% loo.servername | html %]"><i class="fa fa-trash-can"></i> Delete</a> @@ -273,7 +273,7 @@ [% INCLUDE 'datatables.inc' %] [% END %] <script> - [% IF ( add_form ) %] + [% IF op == 'edit_form' || op == 'add_form' %] $(document).ready(function(){ // Update selects for syntax, encoding and recordtype [% IF server %] -- 2.43.0