From f5aeed9a474ab2273721f62b27f5a031f6e17599 Mon Sep 17 00:00:00 2001 From: Fridolin Somers Date: Fri, 17 Oct 2025 11:44:30 +0200 Subject: [PATCH] Bug 41043: Use op 'add_form' and 'edit_form' in oai servers Since CSRF protection, 'op' arg for creating/editing an object uses add_form and edit_form. This is missing only in admin/oai_servers.pl This patch also removes TT variable add_form to avoid confusion Test plan : 1) Create a new OAI repository 2) Enter mandatory datas in form and save 3) Edit this repository 4) Copy this repository --- admin/oai_servers.pl | 9 +++---- .../prog/en/modules/admin/oai_servers.tt | 24 +++++++++---------- 2 files changed, 17 insertions(+), 16 deletions(-) diff --git a/admin/oai_servers.pl b/admin/oai_servers.pl index 53b44adb27..9dcdd60178 100755 --- a/admin/oai_servers.pl +++ b/admin/oai_servers.pl @@ -90,12 +90,13 @@ if ( $op eq 'cud-delete_confirmed' && $id ) { # Now list multiple records, or edit one record my $data = []; -if ( $op eq 'add' || $op eq 'edit' ) { +if ( $op eq 'add_form' || $op eq 'edit_form' ) { $data = server_search( $schema, $id, $searchfield ) if $searchfield || $id; - delete $data->[0]->{id} if @$data && $op eq 'add'; #cloning record + delete $data->[0]->{id} if @$data && $op eq 'add_form'; #cloning record $template->param( - add_form => 1, server => @$data ? $data->[0] : undef, - op => $op, type => $op eq 'add' ? lc $type : '' + server => @$data ? $data->[0] : undef, + op => $op, + type => ( $op eq 'add_form' ) ? lc $type : '' ); } else { $data = server_search( $schema, $id, $searchfield ); diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_servers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_servers.tt index f6fb85e39c..3a17652404 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_servers.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_servers.tt @@ -7,11 +7,11 @@ [% PROCESS 'i18n.inc' %] - [% IF op == 'edit' %] + [% IF op == 'edit_form' %] Modify OAI repository [% server.servername | html %] › [% END %] - [% IF op == 'add' %] + [% IF op == 'add_form' %] New OAI repository › [% END %] OAI repositories › Administration › Koha @@ -30,17 +30,17 @@ <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> [% END %] - [% IF op == 'edit' || op == 'add' %] + [% IF op == 'edit_form' || op == 'add_form' %] [% WRAPPER breadcrumb_item %] <a href="/cgi-bin/koha/admin/oai_servers.pl">OAI repositories</a> [% END %] [% END %] - [% IF op == 'edit' %] + [% IF op == 'edit_form' %] [% WRAPPER breadcrumb_item bc_active= 1 %] <span>Modify OAI repository [% server.servername | html %]</span> [% END %] - [% ELSIF op == 'add' %] + [% ELSIF op == 'add_form' %] [% WRAPPER breadcrumb_item bc_active= 1 %] <span>New OAI repository</span> [% END %] @@ -64,10 +64,10 @@ <div class="alert alert-warning">Error: Server with ID [% msg_add | html %] not found</div> [% END %] - [% IF ( add_form ) %] + [% IF op == 'edit_form' || op == 'add_form' %] <form action="/cgi-bin/koha/admin/oai_servers.pl" name="Aform" method="post" id="serverentry"> [% INCLUDE 'csrf-token.inc' %] - [% IF op == 'edit' %] + [% IF op == 'edit_form' %] <h1>Modify OAI repository</h1> <input type="hidden" name="id" value="[% server.oai_server_id | html %]" /> [% ELSE %] @@ -121,7 +121,7 @@ [% IF op == 'list' %] <div id="toolbar" class="btn-toolbar"> - <a id="newserver" class="btn btn-default" href="/cgi-bin/koha/admin/oai_servers.pl?op=add"><i class="fa fa-plus"></i> New OAI repository</a> + <a id="newserver" class="btn btn-default" href="/cgi-bin/koha/admin/oai_servers.pl?op=add_form"><i class="fa fa-plus"></i> New OAI repository</a> </div> <h1>OAI repositories</h1> [% IF id %] @@ -139,7 +139,7 @@ [% FOREACH loo IN loop %] <tr> <td>[% loo.oai_server_id | html %]</td> - <td><a href="/cgi-bin/koha/admin/oai_servers.pl?op=edit&id=[% loo.oai_server_id | uri %]">[% loo.servername | html %]</a></td + <td><a href="/cgi-bin/koha/admin/oai_servers.pl?op=edit_form&id=[% loo.oai_server_id | uri %]">[% loo.servername | html %]</a></td ><td>[% loo.endpoint | html %]</td><td>[% loo.oai_set | html %]</td> <td>[% loo.dataformat | html %]</td> <td @@ -154,10 +154,10 @@ <a class="btn btn-default btn-xs dropdown-toggle" id="reportactions[% savedreport.id | html %]" role="button" data-bs-toggle="dropdown" href="#"> Actions </a> <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="reportactions[% savedreport.id | html %]"> <li - ><a class="dropdown-item" href="/cgi-bin/koha/admin/oai_servers.pl?op=edit&id=[% loo.oai_server_id | uri %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a></li + ><a class="dropdown-item" href="/cgi-bin/koha/admin/oai_servers.pl?op=edit_form&id=[% loo.oai_server_id | uri %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a></li > <li - ><a class="dropdown-item" href="/cgi-bin/koha/admin/oai_servers.pl?op=add&id=[% loo.oai_server_id | uri %]"><i class="fa fa-copy"></i> Copy</a></li + ><a class="dropdown-item" href="/cgi-bin/koha/admin/oai_servers.pl?op=add_form&id=[% loo.oai_server_id | uri %]"><i class="fa fa-copy"></i> Copy</a></li > <li> <a href="#" class="dropdown-item delete" data-formid="server_row_[% loo.oai_server_id | uri %]" data-servername="[% loo.servername | html %]"><i class="fa fa-trash-can"></i> Delete</a> @@ -185,7 +185,7 @@ [% INCLUDE 'datatables.inc' %] [% END %] <script> - [% IF ( add_form ) %] + [% IF op == 'edit_form' || op == 'add_form' %] $(document).ready(function(){ // Update selects for dataformat and recordtype [% IF server %] -- 2.43.0