From 82fe22ff26fdcc203d1a6f9c281bd56cfff08f70 Mon Sep 17 00:00:00 2001
From: Brendan Lawlor <blawlor@clamsnet.org>
Date: Wed, 17 Apr 2024 20:57:34 +0000
Subject: [PATCH] Bug 36630: Change Post to GET to fix CSRF error on item
 search batch operations buttons

This patch changes the form that submits to batchMod.pl from the Item search results page. The form method does not need to be a POST.

    To recreate:

    1. Do an item search
    2. On the results page 'click Select visible rows'
    3. Click 'Batch operations' and select 'Batch item modification'
    4. See Programming error - op 'show' must start with 'cud-' for POST http://localhost:8081/intranet/tools/batchMod.pl (referer: http://localhost:8081/cgi-bin/koha/catalogue/itemsearch.pl)
    5. Click 'Batch operations' and select 'Batch item deletion'
    6. See the same error

    To test:
    1. Apply patch and repeat steps to recreate the issue
    2. See that the batchMod.pl page loads with no error.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
---
 .../intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt    | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt
index 2b064b157f..be573fb7e1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt
@@ -279,9 +279,8 @@
         </div>
       </div>
 
-        <form method="POST" action="/cgi-bin/koha/tools/batchMod.pl" id="batch_item_operations">
-            [% INCLUDE 'csrf-token.inc' %]
-            <input type="hidden" name="op" value="cud-show" />
+        <form method="GET" action="/cgi-bin/koha/tools/batchMod.pl" id="batch_item_operations">
+            <input type="hidden" name="op" value="show" />
             <input type="hidden" id="batch_mod_del" name="del" value="0" />
         </form>
 
-- 
2.39.5