From 23bf1c23808daa11c6afada70e854ad1bd6e3da7 Mon Sep 17 00:00:00 2001
From: Nick Clemens <nick@bywatersolutions.com>
Date: Thu, 1 Feb 2024 09:59:26 -0500
Subject: [PATCH] Bug 34478: Manual fix - add op and change link to form -
 members-toolbar.inc / patron_messages.inc

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
---
 circ/add_message.pl                            |  5 +++--
 circ/del_message.pl                            |  3 ++-
 .../prog/en/includes/members-toolbar.inc       |  1 +
 .../prog/en/includes/patron_messages.inc       | 18 ++++++++++++++++--
 4 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/circ/add_message.pl b/circ/add_message.pl
index 37fb2d14bc..fb24d5ce78 100755
--- a/circ/add_message.pl
+++ b/circ/add_message.pl
@@ -35,6 +35,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
     }
 );
 
+my $op               = $input->param('op');
 my $message_id       = $input->param('message_id');
 my $borrowernumber   = $input->param('borrowernumber');
 my $branchcode       = $input->param('branchcode');
@@ -42,11 +43,11 @@ my $message_type     = $input->param('message_type');
 my $borrower_message = $input->param('borrower_message');
 my $batch            = $input->param('batch');
 
-if ($message_id) {
+if ( $op eq 'cud-edit_message' && $message_id) {
     my $message = Koha::Patron::Messages->find($message_id);
     $message->update( { message => $borrower_message } ) if $message;
 }
-else {
+elsif( $op eq 'cud-add_message' ) {
     Koha::Patron::Message->new(
         {
             borrowernumber => $borrowernumber,
diff --git a/circ/del_message.pl b/circ/del_message.pl
index 3e7c775666..64db58bafe 100755
--- a/circ/del_message.pl
+++ b/circ/del_message.pl
@@ -35,6 +35,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
     }
 );
 
+my $op             = $input->param('op');
 my $borrowernumber = $input->param('borrowernumber');
 my $message_id     = $input->param('message_id');
 
@@ -47,7 +48,7 @@ if ( $message
     exit;
 }
 
-$message->delete if $message;
+$message->delete if $message && $op eq 'cud-delete';
 
 if ( $input->param('from') eq  "moremember" ) {
     print $input->redirect(
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
index 792661e5f3..f1965dd6b5 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
@@ -120,6 +120,7 @@
         <div class="modal-content">
             <form method="post" action="/cgi-bin/koha/circ/add_message.pl" id="message_form" name="message_f">
                 [% INCLUDE 'csrf-token.inc' %]
+                <input type="hidden" name="op" value="cud-add_message">
                 <div class="modal-header">
                     <h3>Leave a message</h3>
                 </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc
index 8ac6e6a1c2..1a57c097f4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc
@@ -321,10 +321,23 @@
                     [% IF patron_message.branchcode == Branches.GetLoggedInBranchcode OR Koha.Preference('AllowAllMessageDeletion') %]
                         [% IF moremember %]
                             <a id="#edit_message_form_[% patron_message.message_id | html %]" class="btn btn-link edit_message" href="#edit_message_form_[% patron_message.message_id | uri %]" data-target="#edit_message_form_[% patron_message.message_id | html %]" data-toggle="modal" class="btn btn-default"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a>
-                            <a class="btn btn-link delete_message" href="/cgi-bin/koha/circ/del_message.pl?message_id=[% patron_message.message_id | html %]&amp;borrowernumber=[% patron_message.borrowernumber | html %]&amp;from=moremember"><i class="fa fa-trash-can"></i> Delete</a>
+                            <form action="/cgi-bin/koha/circ/del_message.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
+                                <input type="hidden" name="op" value="cud-delete">
+                                <input type="hidden" name="message_id" value="[% patron_message.message_id | html %]">
+                                <input type="hidden" name="borrowernumber" value="[% patron_message.borrowernumber | html %]">
+                                <input type="hidden" name="from" value="moremember">
+                                <button type="submit" class="btn btn-link delete_message"><i class="fa fa-trash-can"></i> Delete</button>
+                            </form>
                         [% ELSE %]
                             <a id="#edit_message_form_[% patron_message.message_id | html %]" class="btn btn-link edit_message" href="#edit_message_form_[% patron_message.message_id | uri %]" data-target="#edit_message_form_[% patron_message.message_id | html %]" data-toggle="modal" class="btn btn-default"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a>
-                            <a class="btn btn-link delete_message" href="/cgi-bin/koha/circ/del_message.pl?message_id=[% patron_message.message_id | html %]&amp;borrowernumber=[% patron_message.borrowernumber | html %]"><i class="fa fa-trash-can"></i> Delete</a>
+                            <form action="/cgi-bin/koha/circ/del_message.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
+                                <input type="hidden" name="op" value="cud-delete">
+                                <input type="hidden" name="message_id" value="[% patron_message.message_id | html %]">
+                                <input type="hidden" name="borrowernumber" value="[% patron_message.borrowernumber | html %]">
+                                <button type="submit" class="btn btn-link delete_message"><i class="fa fa-trash-can"></i> Delete</button>
+                            </form>
                         [% END %]
                     [% END %]
                 </li>
@@ -339,6 +352,7 @@
                 <div class="modal-content">
                     <form method="post" action="/cgi-bin/koha/circ/add_message.pl" id="message_form" name="message_f">
                         [% INCLUDE 'csrf-token.inc' %]
+                        <input type="hidden" name="op" value="cud-edit_message">
                         <input type="hidden" name="message_id" value="[% pm.message_id | html %]"/>
                         <div class="modal-header">
                             <h3>Edit message</h3>
-- 
2.39.5