Bug 34478: Manual fix - tools/batchMod-del

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - admin/systempreferences

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - admin/patron-attr-types

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - admin/matching-rules

Bug 34478: [TO SQUASH] Manual fix - admin/matching-rules

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - acqui/basket.pl - export

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - acqui/duplicate_orders.tt

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - acqui/vendor_issues.pl

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Correct check of list op in batch record modification

The "list" step (previewing records to be modified) is a post operation
so the op must be cud-list.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - add cud- op for checkouts - circulation.tt

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Fix style and markup of forms within dropdowns

This patch adds some CSS for handling the style of form buttons inside
Bootstrap dropdowns and corrects related markup in two places: Authority
search results and Suggestion management.

Buttons should look correct if we avoid using <fieldset> inside
dropdowns and make sure the button has "btn btn-default" classes.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Fix selenium/administration_tasks.t

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - add cud- op - alert-subscriptions.pl

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - remove csrf - histsearch.tt

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - add cud- ops or remove form submit - returns.tt / checkin-search-box.inc

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Remove warnings from members/memberentry.pl

Use of uninitialized value $op in string eq at /kohadevbox/koha/members/memberentry.pl line 86.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - Make Koha::Token use session id not userenv id

Bug 34478: [TO SQUASH] Manual fix - Make Koha::Token use session id not userenv id

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Fix sco-patron-image.pl access control regression

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Update numbering patterns modification and deletion

The numbering patterns script has been update to look for "cud-modify"
to load the edit form, but that's a GET operation and can stay "modify."

The delete buttons have been updated to be a POSTed form.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Comment deletion should be POSTed form

This patch updates the "Delete" button on the comments moderation page
to convert the GET link to a posted form.

Unrelated: The JavaScript has also been modified so that it asks for
confirmation.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Item removal deletion should be POSTed form

This patch updates the "Remove" button from items which are in a
rotating collection (in the "Manage items" stage). A GET link is
converted to a posted form.

Unrelated: The JavaScript has also been modified so that it asks for
confirmation.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Fix name of CGI variable

'$query->param' in this script should be '$input->param'

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Convert patron file delete link to a posted form

This patch modifies the patron file template to convert the "Delete"
link to a form which includes the CSRF token. The script has already
been modified to check for the "op" value updated in the template.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Fix various parameters on housebound details page

This patch converts the delivery delete buttons to a form and changes
the corresponding op check in the script.

The patch also fixes an error in the form markup and corrects the op
parameter name in several links.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Correct value of "op" when loading the edit form.

The op doesn't need "cud-" because it's a GET operation.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Correct op value for SMS provider deletion

The op value is set in the JavaScript, where it hasn't been updated to
match the "cud-delete" value checked in the script.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Corrections to add and delete of OAI sets

This patch makes two changes: The first changes the name of the op value
matched in the script when editing a set. The "mod" step is a GET
operation to load the edit form.

The second change is a workaround for the fact that a submit
button looks bad in a Bootstrap dropdown. The patch creates a hidden
form for deletion operations. Clicking a "delete" link in a dropdown
fills the hidden form with the OAI set id to be deleted and submits it.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Item type deletion - correct delete_confirm and delete_confirmed

"delete_confirm" is a GET operation leading to a confirmation page,
where "cud-delete_confirmed" should submit a POST to delete.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Convert item search field delete to POST form

This patch converts the delete link on the item search field page to a
form with a POST operation.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Fix op variable in item circulation alerts

The AJAX call in the template still used "action" instead of
"op".

The patch also fixes references to "action" in the POD and corrects
"toggle" to "cud-toggle".

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Add notes to pay.pl

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Add cud-pay and cud-writeoff to paycollect

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Add op to pay_individual

I also move the writeoff handling out of it's own block in into the rest
of the x_individual handling.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Move writeoff-individual to paycollect.pl

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Fix op check in table settings admin

The "action" hidden field was renamed to "op", but "action" was still
being looked for in the script.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Changes for opac-shareshelf

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Changes for suggestion/suggestion

Too much changes needed. Main functionality works again.
Some improvements can still be made.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Make plack.psgi change more comprehensive

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Classification config - Convert delete links to form POSTS

This patch converts the delete links on the classification
configuration page for sources, filing rules, and splitting rules to
POST forms.

A couple of op checks in the script are corrected to match.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Cities - Incorrect op check for cud-delete_confirm

On the cities administration page, the delete button is a GET operation
to a second form for confirmation.

This script should be checking for op=delete_confirm, not
cud-delete_confirm.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Convert authorised value delete link to POST form

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Authority frameworks - first subfield delete button has incorrect op value

From the list of a tag's subfields (e.g.
/cgi-bin/koha/admin/auth_subfields_structure.pl?tagfield=245&frameworkcode=)
the delete button is a GET operation to a second form for confirmation.

This script should be checking for op=delete_confirm, not cud-delete-confirm.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Frameworks - first subfield delete button has incorrect op value

From the list of a tag's subfields (e.g.
/cgi-bin/koha/admin/marc_subfields_structure.pl?tagfield=245&frameworkcode=)
the delete button is a GET operation to a second form for confirmation.

This script should be checking for op=delete_confirm, not
cud-delete-confirm.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Convert EDIFACT messages deletion to POST

Modify DataTables rendering to put the delete button inside a POSTed
form.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Use op and cud in pay -> paycollect redirect

The pay to paycollect post/redirect flow here doesn't actually
consistute a state change, however it's much simpler to add the csrf
token check flow here than to refactor the code to a get (url's quickly
grow too large for a GET) or rework it in other ways.  I opted to do
this for now and work on a refactor at a future date.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Re-correct account-table pay

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Basket group export CSV option should not check cud-op

The Export CSV operation is GET and uses op=export, so the script should
not check for "cud-op."

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Changes for authorities/searchresultlist (new delete form)

Replaces a delete with GET.
FIXME: Trouble with closing dropdown.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Regression - fix installer stuck

Installer was stuck after "Set up database" with a blank page

It also fixes 00-onboarding.t

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Regression - fix change auth type

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Regression - fix change framework

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: (follow-up) Change invoice files delete link to POST

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - Fix controller op handling of self-checkout

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - Fix session cookie management of self-checkout

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - Remove csrf_token from GET to sco-patron-image.pl

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - Remove cud-search from z3950-admin-search.inc

Convert POST to GET for z3950 server search

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - change links to JS form submission - change action to op - request.pl/.tt

Bug 34478: [TO SQUASH] Manual fix - change links to JS form submission - cleanup comments and unused routine - request.pl/.tt

Bug 34478: [TO SQUASH] Manual fix - link to js post and add op to form - request.tt

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - change 'phase' to 'op' add cud- - mana-share-report

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Rename the cud op for the statess account redirection form

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Update op for opac-account-pay

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Add op cud-stateless for account-table.inc

This form calls a payment plugin to prep a new form that submits to a
the payment site external to Koha.

This form does not change state but a change to GET would cause failures
if trying to pay more than 133 fees on Chrome ( but not Firefox ).

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Fix link to batch patron mod from reports

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Move to get for modborrowers

Bug 34478: [TO SQUASH] tools/modborrowers

We actually want to POST here to not reach the limit of a GET request.
It also fixes the following warning in the console:
  Form contains enctype=multipart/form-data, but does not contain method=post.  Submitting normally with method=GET and no enctype instead.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: guided_reports - run is stateless

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - audio alerts

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Clarify opac serial alert subscriptions

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual - Replace link with submit button - circu-menu

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual - change to get and remove CSRF - boraccount

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - change to GET - overdrive-checkout.inc

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - convert link to form - boraccount.tt

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - change to get remove csrf token - installer/step2

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - change to get remove csrf token - installer/step1

This form allows the user to select which language they wish to work
through the installer in, it doesn't update anything serverside.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - change to get remove csrf token - barcode-print

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - change to get remove csrf token - downloadcard

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Add 'op' to reports/guided_reports - WIP

Bug 34478: [TO SQUASH] Add 'op' to reports/guided_reports

Found bug 36071 when working on this. This is not a regression from this
patch.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Add 'op' to sendbasketform

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - change to get remove csrf token - citites-admin-search

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - change to get remove csrf token - contracts-admin-search

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - change to get remove csrf token - acquisitions-search

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - change to get remove csrf token - budgets-admin-search

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Add 'op' to circ/renew.pl

Added 'cud-renew' op check to circ/renew.pl and added corresponding op
params to:

* includes/renew-search-box.tt
* circ/renew.tt

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Changes for labels/spinelabel-print.pl (no POST)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Changes for tools/cleanborrowers

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - change to get remove csrf token - member-search-box

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - change to get remove csrf token - preservation-search

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - change to get remove csrf token - letters-search

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - change to get remove csrf token - patron-search-box

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: (QA follow-up) Rename change to delete

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Changes for tools/upload

Required some more changes for mode to op, and delete form.
Most forms did not need a POST.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: (follow-up) Remove check_csrf from pl files

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Changes for tools/stage-marc-import

First form is ajax upload, no post needed.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Changes for tools/import_borrowers

Removed a csrf check in script itself.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Changes for tools/viewlog (no POST, just viewing)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Changes for tools/upload-images

First upload form does not submit (ajax processing).

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Changes for tools/scheduler

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Changes for tools/holidays

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Changes for overduerules.tt (remove POST for branch selection)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Changes for offline_circ

Removed an unused form from process_koc.tt and an unused
op from process_koc.pl.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Manual fix - change to get - reports

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: op =~ ^cud- - Manual - cud-do_it => do_it

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 34478: Add 'op' to circ/branchtransfers

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>