From 711c399222f7dbe1caf8da45b1e488b7efa0a1be Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Date: Fri, 13 Sep 2024 13:59:08 +0100
Subject: [PATCH] Bug 37916: Convert plugin install button to form

This patch takes the usual approach of converting linked buttons to form
with the csrf token included.

Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
---
 .../prog/en/modules/plugins/plugins-home.tt            | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-home.tt
index 1f09d11191..b8b7f764c0 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-home.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-home.tt
@@ -102,7 +102,15 @@
                                         <td>[% sr.result.description | html %]</td>
                                         <td>[% sr.repo.name | html %]</td>
                                         <td>[% sr.result.tag_name | html %]</td>
-                                        <td><a class="btn btn-default btn-sm btn-install-plugin" href="/cgi-bin/koha/plugins/plugins-upload.pl?op=Upload&uploadfile=[% sr.result.install_name | uri %]&uploadlocation=[% sr.result.install_url | uri %]"><i class="fa fa-download"></i> Install</a></td>
+                                        <td>
+                                            <form method="post" action="/cgi-bin/koha/plugins/plugins-upload.pl">
+                                                [% INCLUDE 'csrf-token.inc' %]
+                                                <input type="hidden" name="op" value="cud-Upload" />
+                                                <input type="hidden" name="uploadfile" value="[% sr.result.install_name | html %]" />
+                                                <input type="hidden" name="uploadlocation" value="[% sr.result.install_url | url %]" />
+                                                <button type="submit" value="Install" class="btn btn-default btn-sm btn-install-plugin"><i class="fa fa-download"></i> Install</button>
+                                            </form>
+                                        </td>
                                     </tr>
                                 [% END %]
                             </table>
-- 
2.39.5