From a75f3b3262dfb451782ce8f2e5e7e342d05b1084 Mon Sep 17 00:00:00 2001
From: Tomas Cohen Arazi <tomascohen@theke.io>
Date: Fri, 25 Apr 2025 13:50:16 -0300
Subject: [PATCH] Bug 38340: (follow-up) Fix CSRF issues

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
---
 .../prog/en/includes/ill/backends/Standard/create.inc          | 3 +++
 .../prog/en/includes/ill/backends/Standard/migrate.inc         | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/create.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/create.inc
index 01c2d5a716..bb02161d3b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/create.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/create.inc
@@ -112,6 +112,7 @@
         <input type="hidden" name="method" value="create" />
         <input type="hidden" name="stage" value="form" />
         <input type="hidden" name="backend" value="Standard" />
+        <input type="hidden" name="op" value="cud-create" />
     </form>
     [% BLOCK backend_jsinclude %]
         <script>
@@ -168,6 +169,7 @@
     <!-- We need to clarify the borrower that has been requested. -->
     <h2>Borrower selection</h2>
     <form method="POST" action="">
+        [% INCLUDE 'csrf-token.inc' %]
         [% FOREACH prop IN whole.value.other.keys %]
             [% IF prop != 'custom_key' &&  prop != 'custom_value' && prop != 'cardnumber' %]
                 <input type="hidden" name="[% prop | html %]" value="[% whole.value.other.$prop | html %]" />
@@ -203,6 +205,7 @@
             <input type="submit" value="Select" />
             <a class="cancel" href="[% parent | url %]">Cancel</a>
         </fieldset>
+        <input type="hidden" name="op" value="cud-choose-borrower" />
     </form>
 [% ELSE %]
     <p>Unknown stage. This should not have happened. </p>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/migrate.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/migrate.inc
index 180c2d9f1b..5a133a9c2f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/migrate.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/migrate.inc
@@ -16,6 +16,7 @@
 [% IF whole.stage == "form" %]
     <h2>Migrating an ILL request</h2>
     <form id="standard_migrate_form" method="POST" action="">
+        [% INCLUDE 'csrf-token.inc' %]
         <fieldset class="rows">
             <legend>General details</legend>
             <ol id="general-standard-fields">
@@ -104,6 +105,7 @@
             <input id="ill-submit" type="submit" value="Migrate" />
             <a class="cancel" href="/cgi-bin/koha/ill/ill-requests.pl">Cancel</a>
         </fieldset>
+        <input type="hidden" name="op" value="cud-migrate" />
     </form>
     [% BLOCK backend_jsinclude %]
         <script>