From c866cb1111e775b707d37aa09d0ed8b282889b4a Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <phil@chetcolibrary.org>
Date: Thu, 5 Sep 2024 15:13:32 -0700
Subject: [PATCH] Bug 37853: Do not POST a form at the end of changing the
 password (OPAC)

Rather than having a form that does a POST (without an op, which isn't proper),
the final step in changing your password in the OPAC should just be a link.

Test plan:
1. Without the patch applied, log in to the OPAC as a user that you don't
   mind changing the password for
2. Welcome, {username} - Your account - Change password
3. Type the old password, and a new password twice, click Change password
4. Below the success message is a green button with white text, Return to
   my account - click it
5. Apply patch
6. Change password, type the (new) old password, and a (newer) new password
   twice, click Change password
7. Below the success message is what looks like a green button with white
   text, Return to my account
8. Hover the button, check your browser status bar for a URL showing you
   that it's now a link. Click it to be sure it works.

Sponsored-by: Chetco Community Public Library
Signed-off-by: Olivier V <olivier.vezina@inLibro.com>

Amended-by: Jonathan Druart
Edited commit message

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
---
 koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
index 6f0efe4e21..13034c733e 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
@@ -107,11 +107,7 @@
                             <br />
                             Your password has been changed
                         </div>
-                        <form action="/cgi-bin/koha/opac-user.pl" method="post" autocomplete="off">
-                            [% INCLUDE 'csrf-token.inc' %]
-                            <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
-                            <p><input type="submit" class="btn btn-primary" value="Return to my account" /></p>
-                        </form>
+                        <a class="btn btn-primary" href="/cgi-bin/koha/opac-user.pl">Return to my account</a>
                     [% END # /IF password_updated %]
                 </div> <!-- / #userpasswd -->
             </div> <!-- / .col-10 -->
-- 
2.39.5