Summary: | Removing an item from a label batch should be a CSRF-protected POST operation | ||
---|---|---|---|
Product: | Koha | Reporter: | Owen Leonard <oleonard> |
Component: | Label/patron card printing | Assignee: | Owen Leonard <oleonard> |
Status: | Needs documenting --- | QA Contact: | Matt Blenkinsop <matt.blenkinsop> |
Severity: | normal | ||
Priority: | P5 - low | CC: | fridolin.somers, lucas, matt.blenkinsop |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Small patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
24.11.00,24.05.06
|
|
Circulation function: | |||
Bug Depends on: | 36192 | ||
Bug Blocks: | |||
Attachments: |
Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation
Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation |
Description
Owen Leonard
2024-06-26 19:53:32 UTC
Created attachment 168237 [details] [review] Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation This patch updates the label batch edit template so that removing a single or multiple items from a batch is a CSRF-protected POST operation. The patch also removes the existing "if ($op eq 'cud-delete') {" section of label-edit-batch.pl because it was unused. To test, apply the patch and go to Cataloging -> Labels. - Create a label batch and add multiple items to it. - From the list of label batches, click "Edit" on the batch you created. - Click the "Delete" button for one of the items in the batch. - If you confirm, the item should be deleted. - In the "Select" column, check multiple checkboxes. - Click the "Remove selected items" button in the toolbar. - Verify that confirming this operation results in the items being deleted from the batch. Sponsored-by: Athens County Public Libraries Created attachment 168288 [details] [review] Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation This patch updates the label batch edit template so that removing a single or multiple items from a batch is a CSRF-protected POST operation. The patch also removes the existing "if ($op eq 'cud-delete') {" section of label-edit-batch.pl because it was unused. To test, apply the patch and go to Cataloging -> Labels. - Create a label batch and add multiple items to it. - From the list of label batches, click "Edit" on the batch you created. - Click the "Delete" button for one of the items in the batch. - If you confirm, the item should be deleted. - In the "Select" column, check multiple checkboxes. - Click the "Remove selected items" button in the toolbar. - Verify that confirming this operation results in the items being deleted from the batch. Sponsored-by: Athens County Public Libraries Signed-off-by: David Nind <david@davidnind.com> Created attachment 168341 [details] [review] Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation This patch updates the label batch edit template so that removing a single or multiple items from a batch is a CSRF-protected POST operation. The patch also removes the existing "if ($op eq 'cud-delete') {" section of label-edit-batch.pl because it was unused. To test, apply the patch and go to Cataloging -> Labels. - Create a label batch and add multiple items to it. - From the list of label batches, click "Edit" on the batch you created. - Click the "Delete" button for one of the items in the batch. - If you confirm, the item should be deleted. - In the "Select" column, check multiple checkboxes. - Click the "Remove selected items" button in the toolbar. - Verify that confirming this operation results in the items being deleted from the batch. Sponsored-by: Athens County Public Libraries Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> Pushed for 24.11! Well done everyone, thank you! Backported to 24.05.x for upcoming 24.05.06 Not for 23.11.x |