From f2394c8c092ac593ecb6c52c3123adcda622134a Mon Sep 17 00:00:00 2001
From: Owen Leonard <oleonard@myacpl.org>
Date: Fri, 23 Feb 2024 18:58:16 +0000
Subject: [PATCH] Bug 34478: Corrections to some serials scripts

This patch updates the serials toolbar and related JS so that delete,
close, and reopen are all POST operations.

The patch also fixes an incorrect op check in the subscription search
popup.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
---
 .../prog/en/includes/serials-toolbar.inc      | 25 ++++++++++++--
 .../intranet-tmpl/prog/js/serials-toolbar.js  | 34 ++++---------------
 serials/subscription-bib-search.pl            |  2 +-
 serials/subscription-detail.pl                |  4 +--
 4 files changed, 31 insertions(+), 34 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/serials-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/serials-toolbar.inc
index 85811729dd..7757a9af70 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/serials-toolbar.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/serials-toolbar.inc
@@ -40,7 +40,12 @@
 
                             [% IF ( CAN_user_serials_delete_subscription ) %]
                                 <li>
-                                    <a href="#" id="deletesub">Delete subscription</a>
+                                    <form action="subscription-detail.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
+                                        <input type="hidden" name="op" value="cud-del" />
+                                        <input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]" />
+                                        <button type="submit" class="btn btn-default" id="deletesub">Delete subscription</button>
+                                    </form>
                                 </li>
                             [% END %]
                         </ul>
@@ -57,9 +62,23 @@
             [% END %]
             [% UNLESS cannotedit %]
                 [% IF closed %]
-                    <div class="btn-group"><a id="reopen" class="btn btn-default" href="#"><i class="fa-solid fa-arrow-rotate-right"></i> Reopen</a></div>
+                    <div class="btn-group">
+                        <form action="subscription-detail.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
+                            <input type="hidden" name="op" value="cud-reopen" />
+                            <input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]" />
+                            <button type="submit" class="btn btn-default" id="reopen"><i class="fa-solid fa-arrow-rotate-right"></i> Reopen</button>
+                        </form>
+                    </div>
                 [% ELSE %]
-                    <div class="btn-group"><a id="close" class="btn btn-default" href="#"><i class="fa fa-times-circle"></i> Close</a></div>
+                    <div class="btn-group">
+                        <form action="subscription-detail.pl" method="post">
+                            [% INCLUDE 'csrf-token.inc' %]
+                            <input type="hidden" name="op" value="cud-close" />
+                            <input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]" />
+                            <button type="submit" class="btn btn-default" id="close"><i class="fa fa-times-circle"></i> Close</button>
+                        </form>
+                    </div>
                 [% END %]
             [% END %]
         [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/js/serials-toolbar.js b/koha-tmpl/intranet-tmpl/prog/js/serials-toolbar.js
index e68173d950..1c4bb69538 100644
--- a/koha-tmpl/intranet-tmpl/prog/js/serials-toolbar.js
+++ b/koha-tmpl/intranet-tmpl/prog/js/serials-toolbar.js
@@ -1,40 +1,18 @@
-/* global subscriptionid */
+/* global subscriptionid __ */
 
-function confirm_close() {
-    var is_confirmed = confirm( __("Are you sure you want to close this subscription?") );
-    if (is_confirmed) {
-        window.location="subscription-detail.pl?subscriptionid=" + subscriptionid + "&op=close";
-    }
-}
-function confirm_reopen() {
-    var is_confirmed = confirm( __("Are you sure you want to reopen this subscription?") );
-    if (is_confirmed) {
-        window.location="subscription-detail.pl?subscriptionid=" + subscriptionid + "&op=reopen";
-    }
-}
-
-function confirm_deletion() {
-    var is_confirmed = confirm( __("Are you sure you want to delete this subscription?") );
-    if (is_confirmed) {
-        window.location="subscription-detail.pl?subscriptionid=" + subscriptionid + "&op=del";
-    }
-}
 function popup(subscriptionid) {
     newin=window.open("subscription-renew.pl?mode=popup&subscriptionid="+subscriptionid,'popup','width=590,height=440,toolbar=false,scrollbars=yes');
 }
 
  $(document).ready(function() {
-    $("#deletesub").click(function(){
-        confirm_deletion();
-        return false;
+    $("#deletesub").on("click", function(){
+        return confirm( __("Are you sure you want to delete this subscription?") );
     });
     $("#reopen").click(function(){
-        confirm_reopen();
-        return false;
+        return confirm( __("Are you sure you want to reopen this subscription?") );
     });
-    $("#close").click(function(){
-        confirm_close();
-        return false;
+    $("#close").on("click", function(){
+        return confirm( __("Are you sure you want to close this subscription?") );
     });
     $("#renew").click(function(){
         popup( subscriptionid );
diff --git a/serials/subscription-bib-search.pl b/serials/subscription-bib-search.pl
index 1f2b46b3f8..c0f38193a6 100755
--- a/serials/subscription-bib-search.pl
+++ b/serials/subscription-bib-search.pl
@@ -74,7 +74,7 @@ my $itype_or_itemtype =
 my $query = $input->param('q');
 
 # don't run the search if no search term !
-if ( $op eq "cud-do_search" && $query ) {
+if ( $op eq "do_search" && $query ) {
 
     ( $template, $loggedinuser, $cookie ) = get_template_and_user(
         {
diff --git a/serials/subscription-detail.pl b/serials/subscription-detail.pl
index fbb4f8bbbb..cafc994088 100755
--- a/serials/subscription-detail.pl
+++ b/serials/subscription-detail.pl
@@ -40,9 +40,9 @@ my $dbh            = C4::Context->dbh;
 my $subscriptionid = $query->param('subscriptionid');
 my $subscription = Koha::Subscriptions->find( $subscriptionid );
 
-if ( $op and $op eq "close" ) {
+if ( $op and $op eq "cud-close" ) {
     C4::Serials::CloseSubscription( $subscriptionid );
-} elsif ( $op and $op eq "reopen" ) {
+} elsif ( $op and $op eq "cud-reopen" ) {
     C4::Serials::ReopenSubscription( $subscriptionid );
 }
 
-- 
2.39.5