gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 31632: (follow-up) CSRF protection for linking order to suggestion 

Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Aleisha Amohia 2024-09-02 23:55:00 +00:00 committed by Lucas Gass
parent 8643b6c0fd
commit 73de7c716e
No known key found for this signature in database
GPG Key ID: 60B447398B0D36CA
3 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
acqui/newordersuggestion.pl
View File

@ -129,7 +129,7 @@ if ( $op eq 'connectDuplicate' ) {
ConnectSuggestionAndBiblio( $suggestionid, $duplicateNumber );
}
if ( $op eq 'link_order' and $link_order ) {
if ( $op eq 'cud-link_order' and $link_order ) {
my $order = Koha::Acquisition::Orders->find($link_order);
my $suggestion = Koha::Suggestions->find($suggestionid);
$suggestion->update( { biblionumber => $order->biblionumber } ) if $order->biblionumber;

3
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
View File

@ -815,7 +815,7 @@
<br />
[% END %]
[% UNLESS ( books_loo.suggestionid ) %]
<a href="/cgi-bin/koha/acqui/newordersuggestion.pl?booksellerid=[% booksellerid | uri %]&amp;basketno=[% basketno | uri %]&amp;link_order=[% books_loo.ordernumber | uri %]">[% tp('verb', 'Link suggestion') | html %]</a>
<a data-action="/cgi-bin/koha/acqui/newordersuggestion.pl" data-booksellerid="[% booksellerid | uri %]" data-basketno="[% basketno | uri %]" data-link_order="[% books_loo.ordernumber | uri %]" data-method="post" class="submit-form-link" href="#">[% tp('verb', 'Link suggestion') | html %]</a>
[% END %]
</td>
[% END %]
@ -1106,6 +1106,7 @@
[% Asset.js("js/acquisitions-menu.js") | $raw %]
[% INCLUDE 'datatables.inc' %]
[% Asset.js("js/acq.js") | $raw %]
[% Asset.js("js/form-submit.js") | $raw %]
[% INCLUDE 'calendar.inc' %]
<script>
function updateColumnsVisibility(visible) {

2
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt
View File

@ -90,7 +90,7 @@
<td> [% suggestion.total | $Price %] </td>
<td class="actions">
[% IF link_order %]
<a href="/cgi-bin/koha/acqui/newordersuggestion.pl?op=link_order&amp;link_order=[% link_order | uri %]&amp;booksellerid=[% booksellerid | uri %]&amp;basketno=[% basketno | uri %]&amp;suggestionid=[% suggestion.suggestionid | uri %]" class="btn btn-default btn-xs"><i class="fa fa-plus"></i> [% tp('verb', 'Link suggestion') | html %]</a>
<a data-action="/cgi-bin/koha/acqui/newordersuggestion.pl" data-op="cud-link_order" data-link_order="[% link_order | uri %]" data-booksellerid="[% booksellerid | uri %]" data-basketno="[% basketno | uri %]" data-suggestionid="[% suggestion.suggestionid | uri %]" data-method="post" class="btn btn-default btn-xs submit-form-link" href="#"><i class="fa fa-plus"></i> [% tp('verb', 'Link suggestion') | html %]</a>
[% ELSIF ( suggestion.biblionumber ) %]
<a
href="neworderempty.pl?booksellerid=[% booksellerid | uri %]&amp;basketno=[% basketno | uri %]&amp;suggestionid=[% suggestion.suggestionid | uri %]&amp;biblio=[% suggestion.biblionumber | uri %]"