Bug 37206

Summary: Removing an item from a label batch should be a CSRF-protected POST operation
Product: Koha Reporter: Owen Leonard <oleonard>
Component: Label/patron card printingAssignee: Owen Leonard <oleonard>
Status: Signed Off --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low    
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 36192    
Bug Blocks:    
Attachments: Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation
Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation

Description Owen Leonard 2024-06-26 19:53:32 UTC
From Labels -> Manage label batches -> Edit batch, the list of items in the batch has a "Delete" button for each item. Currently it's a GET operation sent via a link, but I think that should be POSTed.
Comment 1 Owen Leonard 2024-06-28 13:24:24 UTC
Created attachment 168237 [details] [review]
Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation

This patch updates the label batch edit template so that removing a
single or multiple items from a batch is a CSRF-protected POST
operation.

The patch also removes the existing "if ($op eq 'cud-delete') {" section
of label-edit-batch.pl because it was unused.

To test, apply the patch and go to Cataloging -> Labels.

- Create a label batch and add multiple items to it.
- From the list of label batches, click "Edit" on the batch you created.
- Click the "Delete" button for one of the items in the batch.
  - If you confirm, the item should be deleted.
- In the "Select" column, check multiple checkboxes.
- Click the "Remove selected items" button in the toolbar.
  - Verify that confirming this operation results in the items being
    deleted from the batch.

Sponsored-by: Athens County Public Libraries
Comment 2 David Nind 2024-06-28 18:58:35 UTC
Created attachment 168288 [details] [review]
Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation

This patch updates the label batch edit template so that removing a
single or multiple items from a batch is a CSRF-protected POST
operation.

The patch also removes the existing "if ($op eq 'cud-delete') {" section
of label-edit-batch.pl because it was unused.

To test, apply the patch and go to Cataloging -> Labels.

- Create a label batch and add multiple items to it.
- From the list of label batches, click "Edit" on the batch you created.
- Click the "Delete" button for one of the items in the batch.
  - If you confirm, the item should be deleted.
- In the "Select" column, check multiple checkboxes.
- Click the "Remove selected items" button in the toolbar.
  - Verify that confirming this operation results in the items being
    deleted from the batch.

Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>