From Labels -> Manage label batches -> Edit batch, the list of items in the batch has a "Delete" button for each item. Currently it's a GET operation sent via a link, but I think that should be POSTed.
Created attachment 168237 [details] [review] Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation This patch updates the label batch edit template so that removing a single or multiple items from a batch is a CSRF-protected POST operation. The patch also removes the existing "if ($op eq 'cud-delete') {" section of label-edit-batch.pl because it was unused. To test, apply the patch and go to Cataloging -> Labels. - Create a label batch and add multiple items to it. - From the list of label batches, click "Edit" on the batch you created. - Click the "Delete" button for one of the items in the batch. - If you confirm, the item should be deleted. - In the "Select" column, check multiple checkboxes. - Click the "Remove selected items" button in the toolbar. - Verify that confirming this operation results in the items being deleted from the batch. Sponsored-by: Athens County Public Libraries
Created attachment 168288 [details] [review] Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation This patch updates the label batch edit template so that removing a single or multiple items from a batch is a CSRF-protected POST operation. The patch also removes the existing "if ($op eq 'cud-delete') {" section of label-edit-batch.pl because it was unused. To test, apply the patch and go to Cataloging -> Labels. - Create a label batch and add multiple items to it. - From the list of label batches, click "Edit" on the batch you created. - Click the "Delete" button for one of the items in the batch. - If you confirm, the item should be deleted. - In the "Select" column, check multiple checkboxes. - Click the "Remove selected items" button in the toolbar. - Verify that confirming this operation results in the items being deleted from the batch. Sponsored-by: Athens County Public Libraries Signed-off-by: David Nind <david@davidnind.com>
Created attachment 168341 [details] [review] Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation This patch updates the label batch edit template so that removing a single or multiple items from a batch is a CSRF-protected POST operation. The patch also removes the existing "if ($op eq 'cud-delete') {" section of label-edit-batch.pl because it was unused. To test, apply the patch and go to Cataloging -> Labels. - Create a label batch and add multiple items to it. - From the list of label batches, click "Edit" on the batch you created. - Click the "Delete" button for one of the items in the batch. - If you confirm, the item should be deleted. - In the "Select" column, check multiple checkboxes. - Click the "Remove selected items" button in the toolbar. - Verify that confirming this operation results in the items being deleted from the batch. Sponsored-by: Athens County Public Libraries Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Pushed for 24.11! Well done everyone, thank you!
Backported to 24.05.x for upcoming 24.05.06