gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 38340: (follow-up) Fix CSRF issues 

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This commit is contained in:
Tomas Cohen Arazi 2025-04-25 13:50:16 -03:00 committed by Katrin Fischer
parent 2671fe5a12
commit a75f3b3262
No known key found for this signature in database
GPG Key ID: 0EF6E2C03357A834
2 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/create.inc
View File

@ -112,6 +112,7 @@
<input type="hidden" name="method" value="create" />
<input type="hidden" name="stage" value="form" />
<input type="hidden" name="backend" value="Standard" />
<input type="hidden" name="op" value="cud-create" />
</form>
[% BLOCK backend_jsinclude %]
<script>
@ -168,6 +169,7 @@
<!-- We need to clarify the borrower that has been requested. -->
<h2>Borrower selection</h2>
<form method="POST" action="">
[% INCLUDE 'csrf-token.inc' %]
[% FOREACH prop IN whole.value.other.keys %]
[% IF prop != 'custom_key' && prop != 'custom_value' && prop != 'cardnumber' %]
<input type="hidden" name="[% prop | html %]" value="[% whole.value.other.$prop | html %]" />
@ -203,6 +205,7 @@
<input type="submit" value="Select" />
<a class="cancel" href="[% parent | url %]">Cancel</a>
</fieldset>
<input type="hidden" name="op" value="cud-choose-borrower" />
</form>
[% ELSE %]
<p>Unknown stage. This should not have happened. </p>

2
koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/migrate.inc
View File

@ -16,6 +16,7 @@
[% IF whole.stage == "form" %]
<h2>Migrating an ILL request</h2>
<form id="standard_migrate_form" method="POST" action="">
[% INCLUDE 'csrf-token.inc' %]
<fieldset class="rows">
<legend>General details</legend>
<ol id="general-standard-fields">
@ -104,6 +105,7 @@
<input id="ill-submit" type="submit" value="Migrate" />
<a class="cancel" href="/cgi-bin/koha/ill/ill-requests.pl">Cancel</a>
</fieldset>
<input type="hidden" name="op" value="cud-migrate" />
</form>
[% BLOCK backend_jsinclude %]
<script>