Bug 37206

Summary: Removing an item from a label batch should be a CSRF-protected POST operation
Product: Koha Reporter: Owen Leonard <oleonard>
Component: Label/patron card printingAssignee: Owen Leonard <oleonard>
Status: Needs documenting --- QA Contact: Matt Blenkinsop <matt.blenkinsop>
Severity: normal    
Priority: P5 - low CC: fridolin.somers, lucas, matt.blenkinsop
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.11.00,24.05.06
Circulation function:
Bug Depends on: 36192    
Bug Blocks:    
Attachments: Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation
Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation
Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation

Description Owen Leonard 2024-06-26 19:53:32 UTC
From Labels -> Manage label batches -> Edit batch, the list of items in the batch has a "Delete" button for each item. Currently it's a GET operation sent via a link, but I think that should be POSTed.
Comment 1 Owen Leonard 2024-06-28 13:24:24 UTC
Created attachment 168237 [details] [review]
Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation

This patch updates the label batch edit template so that removing a
single or multiple items from a batch is a CSRF-protected POST
operation.

The patch also removes the existing "if ($op eq 'cud-delete') {" section
of label-edit-batch.pl because it was unused.

To test, apply the patch and go to Cataloging -> Labels.

- Create a label batch and add multiple items to it.
- From the list of label batches, click "Edit" on the batch you created.
- Click the "Delete" button for one of the items in the batch.
  - If you confirm, the item should be deleted.
- In the "Select" column, check multiple checkboxes.
- Click the "Remove selected items" button in the toolbar.
  - Verify that confirming this operation results in the items being
    deleted from the batch.

Sponsored-by: Athens County Public Libraries
Comment 2 David Nind 2024-06-28 18:58:35 UTC
Created attachment 168288 [details] [review]
Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation

This patch updates the label batch edit template so that removing a
single or multiple items from a batch is a CSRF-protected POST
operation.

The patch also removes the existing "if ($op eq 'cud-delete') {" section
of label-edit-batch.pl because it was unused.

To test, apply the patch and go to Cataloging -> Labels.

- Create a label batch and add multiple items to it.
- From the list of label batches, click "Edit" on the batch you created.
- Click the "Delete" button for one of the items in the batch.
  - If you confirm, the item should be deleted.
- In the "Select" column, check multiple checkboxes.
- Click the "Remove selected items" button in the toolbar.
  - Verify that confirming this operation results in the items being
    deleted from the batch.

Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Comment 3 Matt Blenkinsop 2024-07-02 10:21:42 UTC
Created attachment 168341 [details] [review]
Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation

This patch updates the label batch edit template so that removing a
single or multiple items from a batch is a CSRF-protected POST
operation.

The patch also removes the existing "if ($op eq 'cud-delete') {" section
of label-edit-batch.pl because it was unused.

To test, apply the patch and go to Cataloging -> Labels.

- Create a label batch and add multiple items to it.
- From the list of label batches, click "Edit" on the batch you created.
- Click the "Delete" button for one of the items in the batch.
  - If you confirm, the item should be deleted.
- In the "Select" column, check multiple checkboxes.
- Click the "Remove selected items" button in the toolbar.
  - Verify that confirming this operation results in the items being
    deleted from the batch.

Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Comment 4 Katrin Fischer 2024-07-02 15:22:29 UTC
Pushed for 24.11!

Well done everyone, thank you!
Comment 5 Lucas Gass (lukeg) 2024-11-18 17:41:35 UTC
Backported to 24.05.x for upcoming 24.05.06
Comment 6 Fridolin Somers 2024-12-02 13:44:14 UTC
Not for 23.11.x