Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity

Bug 37979: Toggling item circulation alerts table cells needs to send csrf_token

Browse source 
When you click on a cell in the Item circulation alerts table, the page sends
a POST to /cgi-bin/koha/admin/item_circulation_alerts.pl without including a
csrf_token, which gets back a 403 error because that's sketchy behavior. It
needs to include the token.

Test plan:
1. Administration - Item circulation alerts
2. Open the browser devtools to the console
3. Click on any green table cell
4. It should have turned red, but instead your console turned red with a 403
5. Apply patch, reload
6. Click on any green table cell, it will turn red

Sponsored-by: Chetco Community Public Library

https://bugs.koha-community.org/show_bug.cgi?id=37959
Signed-off-by: Jan Kissig <jkissig@th-wildau.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This commit is contained in:
Phil Ringnalda 2024-09-18 19:41:50 -07:00 committed by Katrin Fischer
parent 4c89e69821
commit 66eabead5f
Signed by: kfischer
GPG key ID: 0EF6E2C03357A834
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
koha-tmpl/intranet-tmpl/prog/en/modules/admin/item_circulation_alerts.tt
View file

@ -211,7 +211,7 @@
url : '/cgi-bin/koha/admin/item_circulation_alerts.pl', url : '/cgi-bin/koha/admin/item_circulation_alerts.pl',
type : 'POST', type : 'POST',
dataType : 'json', dataType : 'json',
data : { op: 'cud-toggle', id: id, branch: $branch }, data : { op: 'cud-toggle', id: id, branch: $branch, csrf_token: $('meta[name="csrf-token"]').attr("content") },
success : function(response){ success : function(response){
if ($branch == '*' && response.classes.match(/default/)) { if ($branch == '*' && response.classes.match(/default/)) {
td.html(disabledForAll); td.html(disabledForAll);