In the list of invoices in invoices.pl, an invoice that can be deleted (because nothing has ever been received into it) has a Delete action that uses submit-form-link and works with CSRF protection. In invoice.pl where you are viewing an individual invoice, the Delete link still thinks that invoice.pl?op=delete will work, which it won't.
Created attachment 173877 [details] [review] Bug 38325: Cannot delete invoice while viewing it The link to delete while viewing an individual invoice needs to be updated to use submit-form-link so it can POST with op='cud-delete'. Test plan: 1. Home - Acquisitions, click Search with an empty Vendor: input 2. Click Receive shipments, enter a number in the Vendor invoice input, click Next 3. In the left sidebar, click Invoices, click Search without any parameters 4. In the row for your invoice, click the invoice number link 5. Next to the Save button, click the Delete link, click OK in the confirmation alert 6. You'll see the page reload, and the URL change to include ?op=delete, but your invoice remains undeleted. 7. Apply patch, reload the page 8. Click Delete, click OK in the confirmation alert 9. Click Search with no parameters, just to make sure the message about "Sorry, but there are no results for your search" really truly means that your invoice was deleted and now you don't have any invoices Sponsored-by: Chetco Community Public Library
Created attachment 173886 [details] [review] Bug 38325: Cannot delete invoice while viewing it The link to delete while viewing an individual invoice needs to be updated to use submit-form-link so it can POST with op='cud-delete'. Test plan: 1. Home - Acquisitions, click Search with an empty Vendor: input 2. Click Receive shipments, enter a number in the Vendor invoice input, click Next 3. In the left sidebar, click Invoices, click Search without any parameters 4. In the row for your invoice, click the invoice number link 5. Next to the Save button, click the Delete link, click OK in the confirmation alert 6. You'll see the page reload, and the URL change to include ?op=delete, but your invoice remains undeleted. 7. Apply patch, reload the page 8. Click Delete, click OK in the confirmation alert 9. Click Search with no parameters, just to make sure the message about "Sorry, but there are no results for your search" really truly means that your invoice was deleted and now you don't have any invoices Sponsored-by: Chetco Community Public Library Signed-off-by: David Nind <david@davidnind.com>