Bug 37206 - Removing an item from a label batch should be a CSRF-protected POST operation
Summary: Removing an item from a label batch should be a CSRF-protected POST operation
Status: Signed Off
Alias: None
Product: Koha
Classification: Unclassified
Component: Label/patron card printing (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Owen Leonard
QA Contact: Testopia
URL:
Keywords:
Depends on: 36192
Blocks:
  Show dependency treegraph
 
Reported: 2024-06-26 19:53 UTC by Owen Leonard
Modified: 2024-06-28 18:58 UTC (History)
0 users

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation (6.49 KB, patch)
2024-06-28 13:24 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation (6.54 KB, patch)
2024-06-28 18:58 UTC, David Nind
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Owen Leonard 2024-06-26 19:53:32 UTC
From Labels -> Manage label batches -> Edit batch, the list of items in the batch has a "Delete" button for each item. Currently it's a GET operation sent via a link, but I think that should be POSTed.
Comment 1 Owen Leonard 2024-06-28 13:24:24 UTC
Created attachment 168237 [details] [review]
Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation

This patch updates the label batch edit template so that removing a
single or multiple items from a batch is a CSRF-protected POST
operation.

The patch also removes the existing "if ($op eq 'cud-delete') {" section
of label-edit-batch.pl because it was unused.

To test, apply the patch and go to Cataloging -> Labels.

- Create a label batch and add multiple items to it.
- From the list of label batches, click "Edit" on the batch you created.
- Click the "Delete" button for one of the items in the batch.
  - If you confirm, the item should be deleted.
- In the "Select" column, check multiple checkboxes.
- Click the "Remove selected items" button in the toolbar.
  - Verify that confirming this operation results in the items being
    deleted from the batch.

Sponsored-by: Athens County Public Libraries
Comment 2 David Nind 2024-06-28 18:58:35 UTC
Created attachment 168288 [details] [review]
Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation

This patch updates the label batch edit template so that removing a
single or multiple items from a batch is a CSRF-protected POST
operation.

The patch also removes the existing "if ($op eq 'cud-delete') {" section
of label-edit-batch.pl because it was unused.

To test, apply the patch and go to Cataloging -> Labels.

- Create a label batch and add multiple items to it.
- From the list of label batches, click "Edit" on the batch you created.
- Click the "Delete" button for one of the items in the batch.
  - If you confirm, the item should be deleted.
- In the "Select" column, check multiple checkboxes.
- Click the "Remove selected items" button in the toolbar.
  - Verify that confirming this operation results in the items being
    deleted from the batch.

Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>