diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc index 22e6a068ce..6352ff912c 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc +++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc @@ -7,6 +7,12 @@ [% message.message | html | html_line_break %]
   Written on [% message.message_date | $KohaDates %] by [% Branches.GetName(message.branchcode) | html %] +
+ [% INCLUDE 'csrf-token.inc' %] + + + +
[% END %] [% IF ( opacnote ) %]
  • [% opacnote | html | html_line_break %]
  • [% END %] diff --git a/opac/opac-routing-lists.pl b/opac/opac-routing-lists.pl index 299bb29e78..48e6383dfd 100755 --- a/opac/opac-routing-lists.pl +++ b/opac/opac-routing-lists.pl @@ -39,7 +39,22 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( } ); -my $patron = Koha::Patrons->find( $borrowernumber ); +my $logged_in_user = Koha::Patrons->find($borrowernumber); +my $message_id = $query->param('message_id'); +my $message = $logged_in_user->messages->find($message_id); + +unless ($message) { + print $query->redirect("/cgi-bin/koha/errors/404.pl"); + exit; +} + +unless ( $op =~ /^cud-/ && $message ) { + # exit early + print $query->redirect("/cgi-bin/koha/opac-user.pl"); + exit; +} + +$message->update({ patron_read_date => dt_from_string }); $template->param( routinglistsview => 1,