Koha/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt
Jonathan Druart b990b953b3 Bug 21993: Display a user-friendly message when the CSRF token is wrong
Instead of dying!

Test plan:
Assuming you have a patron with borrowernumber=51 and another one that
can be deleted with borrowernumber=42

- authorities-home.pl
 * Delete an authority record
 * hit /cgi-bin/koha/authorities/authorities-home.pl?op=delete

- basket/sendbasket.pl
 * Send a basket to someone
 * hit /cgi-bin/koha/basket/sendbasket.pl?email_add=1

- members/apikeys.pl
  * Generate and delete an API key for a patron
  * hit /cgi-bin/koha/members/apikeys.pl?patron_id=51&op=delete

- members/deletemem.pl
  * Delete a patron
  * hit /cgi-bin/koha/members/deletemem.pl?member=42&op=delete_confirmed

- members/mancredit.pl
  * Add a manual credit
  * hit /cgi-bin/koha/members/mancredit.pl?borrowernumber=51&add=1

- members/maninvoice.pl
  * Add a manual invoice
  * hit /cgi-bin/koha/members/maninvoice.pl?borrowernumber=51&add=1

- members/member-flags.pl
  * Change permissions for a patron
  * hit /cgi-bin/koha/members/member-flags.pl?member=51&newflags=1

- members/member-password.pl
  * Change the password for a patron (from the staff interface)
  * hit /cgi-bin/koha/members/member-password.pl?member=51&newpassword=aA1

- members/memberentry.pl
  * Edit some patron's info
  * hit /cgi-bin/koha/members/memberentry.pl?borrowernumber=51&op=save

- members/paycollect.pl
  * Pay an individual fine
  * hit something like /cgi-bin/koha/members/paycollect.pl?borrowernumber=51&pay_individual=1&accounttype=L&amount=1.00&amountoutstanding=1.00&accountlines_id=157&paid=1
  You may need to edit some values

- tools/import_borrowers.pl
  * Import some patrons
  * hit /cgi-bin/koha/tools/import_borrowers.pl?uploadborrowers=1

- tools/picture-upload.pl
  * Upload an image for a patron
  * You will need to edit the html content
  hit Home › Tools › Upload patron images
  then locate the csrf_token input and modify its value

Note for QA:
- Opac is not done as blocking_errors.inc does not exist for this
interface
- ill/ill-requests.pl
I did not manage to replace this occurrence

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2019-01-25 20:38:32 +00:00

41 lines
1.4 KiB
Text

[% INCLUDE 'doc-head-open.inc' %]
<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Sending your cart</title>
[% INCLUDE 'doc-head-close.inc' %]
</head>
<body style="padding: 1em;" id="cart_sendbasketform" class="cart">
<div class="container">[% IF ( email_add ) %]
[% IF ( SENT ) %]
<h3>Message sent</h3>
<p>The cart was sent to: [% email_add | html %]</p>
<p><a class="focus close" href="#">Close window</a></p>
[% END %]
[% IF ( error ) %]
<p>Problem sending the cart...</p>
[% END %]
[% ELSE %]
[% INCLUDE 'blocking_errors.inc' %]
<form action="/cgi-bin/koha/basket/sendbasket.pl" method="post">
<fieldset class="rows">
<legend>Sending your cart</legend>
<ol> <li>
<label for="email_add">Email address:</label>
<input type="text" id="email_add" name="email_add" size="43" class="focus" />
</li>
<li>
<label for="comment">Comment:</label>
<textarea id="comment" name="comment" rows="4" cols="40"></textarea>
</li>
</ol>
</fieldset>
<fieldset class="action"> <input type="submit" value="Send" /> <a class="cancel close" href="#">Cancel</a> </fieldset>
<input type="hidden" name="bib_list" value="[% bib_list | html %]" />
<input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
</form>
[% END %]</div>
</body>
</html>