From 770dd3bde1b8713eb1725ab78543dce582168fc5 Mon Sep 17 00:00:00 2001
From: Lucas Gass <lucas@bywatersolutions.com>
Date: Wed, 23 Aug 2023 18:18:57 +0000
Subject: [PATCH] Bug 34601: Fix edit/delete links on suggestion.tt

1. Make a suggestion
2. Try to edit, delete the suggestion.
3. Error:
4. Apply patch and restart_all
5. Try again and you should not get the error anymore.

Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit b630dfcb080ddbca5e7f14a9c9863989f0252ea3)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
---
 .../prog/en/modules/suggestion/suggestion.tt         |  4 ++--
 suggestion/suggestion.pl                             | 12 ++++++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
index 3dadf1d456..fcbc6bc742 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
@@ -845,9 +845,9 @@
                                                     </td>
                                                     <td class="actions">
                                                         <div class="btn-group dropup">
-                                                            <a class="btn btn-default btn-xs" role="button" href="suggestion.pl?suggestionid=[% s.suggestionid | html %]&amp;op=edit"><i class="fa fa-pencil"></i> Edit</a><a class="btn btn-default btn-xs dropdown-toggle" id="more_actions_[% s.suggestionid | html %]" role="button" data-toggle="dropdown" href="#"><b class="caret"></b></a>
+                                                            <a class="btn btn-default btn-xs" role="button" href="suggestion.pl?suggestionid=[% s.suggestionid | html %]&amp;csrf_token=[% csrf_token | html %]&amp;op=edit"><i class="fa fa-pencil"></i> Edit</a><a class="btn btn-default btn-xs dropdown-toggle" id="more_actions_[% s.suggestionid | html %]" role="button" data-toggle="dropdown" href="#"><b class="caret"></b></a>
                                                             <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="more_actions_[% s.suggestionid | html %]">
-                                                                <li><a class="deletesuggestion" href="suggestion.pl?op=delete&amp;suggestionid=[% s.suggestionid | html %]"><i class="fa fa-trash"></i> Delete</a></li>
+                                                                <li><a class="deletesuggestion" href="suggestion.pl?op=delete&amp;suggestionid=[% s.suggestionid | html %]"&amp;csrf_token=[% csrf_token | html %]><i class="fa fa-trash"></i> Delete</a></li>
                                                                 [% UNLESS s.archived %]
                                                                     <li><a class="archivesuggestion" href="suggestion.pl?op=archive&amp;suggestionid=[% s.suggestionid | html %]"><i class="fa fa-archive"></i> Archive</a></li>
                                                                 [% ELSE %]
diff --git a/suggestion/suggestion.pl b/suggestion/suggestion.pl
index 36a9f063af..6ece2e12b6 100755
--- a/suggestion/suggestion.pl
+++ b/suggestion/suggestion.pl
@@ -33,6 +33,7 @@ use Koha::Acquisition::Currencies;
 use Koha::Libraries;
 use Koha::Patrons;
 use Koha::Suggestions;
+use Koha::Token;
 
 use URI::Escape qw( uri_escape );
 
@@ -531,10 +532,17 @@ foreach my $field ( qw(managedby acceptedby suggestedby budgetid) ) {
     $hashlists{ lc($field) . "_loop" } = \@codes_list;
 }
 
+my $csrf_token = Koha::Token->new->generate_csrf(
+    {
+        session_id => scalar $input->cookie('CGISESSID'),
+    }
+);
+
 $template->param(
     %hashlists,
-    borrowernumber           => ($input->param('borrowernumber') // undef),
-    SuggestionStatuses       => GetAuthorisedValues('SUGGEST_STATUS'),
+    borrowernumber     => ( $input->param('borrowernumber') // undef ),
+    SuggestionStatuses => GetAuthorisedValues('SUGGEST_STATUS'),
+    csrf_token         => $csrf_token,
 );
 output_html_with_http_headers $input, $cookie, $template->output;
 
-- 
2.39.2