From acee057c4c1b04d336971d9a3267156528960c73 Mon Sep 17 00:00:00 2001
From: Nick Clemens <nick@bywatersolutions.com>
Date: Fri, 19 Jan 2024 16:50:47 +0000
Subject: [PATCH] Bug 34478: Manual fix - edi_ean (cud-ediorder)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
---
 acqui/basket.pl                                       |  2 +-
 acqui/edi_ean.pl                                      |  2 +-
 .../intranet-tmpl/prog/en/modules/acqui/basket.tt     | 11 ++++++++---
 .../intranet-tmpl/prog/en/modules/acqui/edi_ean.tt    |  5 +++--
 4 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/acqui/basket.pl b/acqui/basket.pl
index 21055a4b89..d429170cbf 100755
--- a/acqui/basket.pl
+++ b/acqui/basket.pl
@@ -225,7 +225,7 @@ if ( $op eq 'cud-delete_confirm' ) {
     ReopenBasket(scalar $query->param('basketno'));
     print $query->redirect('/cgi-bin/koha/acqui/basket.pl?basketno='.$basket->{'basketno'})
 }
-elsif ( $op eq 'ediorder' ) {
+elsif ( $op eq 'cud-ediorder' ) {
     edi_close_and_order()
 } elsif ( $op eq 'cud-mod_users' ) {
     my $basketusers_ids = $query->param('users_ids');
diff --git a/acqui/edi_ean.pl b/acqui/edi_ean.pl
index e95dbdfe8a..c8f41abbcb 100755
--- a/acqui/edi_ean.pl
+++ b/acqui/edi_ean.pl
@@ -41,7 +41,7 @@ my $basketno = $query->param('basketno');
 if ( @eans == 1 ) {
     my $ean = $eans[0]->ean;
     print $query->redirect(
-        "/cgi-bin/koha/acqui/basket.pl?basketno=$basketno&op=ediorder&ean=$ean"
+        "/cgi-bin/koha/acqui/basket.pl?basketno=$basketno&op=cud-ediorder&ean=$ean"
     );
 }
 else {
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
index 85393f33ae..6534ec8bb0 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
@@ -101,7 +101,12 @@
                                         [% PROCESS csv_export %]
 
                                         [% IF Koha.Preference('EDIFACT') && ediaccount %]
-                                            <div class="btn-group"><a href="/cgi-bin/koha/acqui/edi_ean.pl?op=ediorder&amp;basketno=[% basketno | uri %]&amp;booksellerid=[% booksellerid | uri %]" class="btn btn-default" id="ediorderbutton"><i class="fa fa-download"></i> Create EDIFACT order</a></div>
+                                            <div class="btn-group"><form action="/cgi-bin/koha/acqui/edi_ean.pl" method="post">
+                                                <input type="hidden" name="op" value="cud-ediorder" />
+                                                <input type="hidden" name="basketno" value="[% basketno | html %]" />
+                                                <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
+                                                <button type="submit" class="btn btn-default" id="ediorderbutton"><i class="fa fa-download"></i> Create EDIFACT order</button>
+                                            </form></div>
                                         [% END %]
 
                                         [% IF ( active && books_loop ) %]
@@ -882,7 +887,7 @@
 
                     [% IF edi_confirm %]
                         <div id="closebasket_needsconfirmation" class="dialog alert">
-                            <form action="/cgi-bin/koha/acqui/basket.pl">
+                            <form action="/cgi-bin/koha/acqui/basket.pl" method="post">
                                 <h1>Are you sure you want to generate an EDIFACT order and close basket [% basketname | html %]?</h1>
                                 [% IF CAN_user_acquisition_group_manage %]
                                     <p>
@@ -891,7 +896,7 @@
                                     </p>
                                 [% END %]
                                 <input type="hidden" id="basketno" value="[% basketno | html %]" name="basketno" />
-                                <input type="hidden" value="ediorder" name="op" />
+                                <input type="hidden" value="cud-ediorder" name="op" />
                                 <input type="hidden" name="ean" value="[% ean | html %]" />
                                 <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                                 <input type="hidden" name="confirm" value="1" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/edi_ean.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/edi_ean.tt
index 22e4af5deb..96e122cbcd 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/edi_ean.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/edi_ean.tt
@@ -34,7 +34,8 @@
     <h1>Select the library account submitting the EDI order</h1>
 
     <div class="page-section">
-        <form action="/cgi-bin/koha/acqui/basket.pl" method="get">
+        <form action="/cgi-bin/koha/acqui/basket.pl" method="post">
+            [% INCLUDE 'csrf-token.inc' %]
             <p>Select ordering library account: </p>
             <select id="ean" name="ean">
                 [% FOREACH eanacct IN eans %]
@@ -42,7 +43,7 @@
                 [% END %]
             </select>
             <input type="hidden" id="basketno" value="[% basketno | html %]" name="basketno" />
-            <input type="hidden" value="ediorder" name="op" />
+            <input type="hidden" value="cud-ediorder" name="op" />
             <p>
                 <input type="submit" class="btn btn-primary" value="Send EDI order" />
             </p>
-- 
2.39.5