gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 36630: Change Post to GET to fix CSRF error on item search batch operations buttons 

This patch changes the form that submits to batchMod.pl from the Item search results page. The form method does not need to be a POST.

    To recreate:

    1. Do an item search
    2. On the results page 'click Select visible rows'
    3. Click 'Batch operations' and select 'Batch item modification'
    4. See Programming error - op 'show' must start with 'cud-' for POST http://localhost:8081/intranet/tools/batchMod.pl (referer: http://localhost:8081/cgi-bin/koha/catalogue/itemsearch.pl)
    5. Click 'Batch operations' and select 'Batch item deletion'
    6. See the same error

    To test:
    1. Apply patch and repeat steps to recreate the issue
    2. See that the batchMod.pl page loads with no error.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This commit is contained in:
Brendan Lawlor 2024-04-17 20:57:34 +00:00 committed by Katrin Fischer
parent 68f884d32f
commit 82fe22ff26
No known key found for this signature in database
GPG Key ID: 0EF6E2C03357A834
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt
View File

@ -279,9 +279,8 @@
</div>
</div>
<form method="POST" action="/cgi-bin/koha/tools/batchMod.pl" id="batch_item_operations">
[% INCLUDE 'csrf-token.inc' %]
<input type="hidden" name="op" value="cud-show" />
<form method="GET" action="/cgi-bin/koha/tools/batchMod.pl" id="batch_item_operations">
<input type="hidden" name="op" value="show" />
<input type="hidden" id="batch_mod_del" name="del" value="0" />
</form>