From 38b94cf964a2826b1afab4be3ef78c11dfdafa92 Mon Sep 17 00:00:00 2001
From: Owen Leonard <oleonard@myacpl.org>
Date: Tue, 20 Feb 2024 19:19:24 +0000
Subject: [PATCH] Bug 34478: Item removal deletion should be POSTed form

This patch updates the "Remove" button from items which are in a
rotating collection (in the "Manage items" stage). A GET link is
converted to a posted form.

Unrelated: The JavaScript has also been modified so that it asks for
confirmation.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
---
 .../prog/en/modules/rotating_collections/addItems.tt  | 11 ++++++++++-
 .../intranet-tmpl/prog/js/rotating-collections.js     |  6 +++++-
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/addItems.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/addItems.tt
index 593c08ec0c..8f0b491d5f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/addItems.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/addItems.tt
@@ -131,7 +131,16 @@
                         <td>[% INCLUDE 'biblio-title.inc' biblio=collectionItemsLoo link = 1 %]</td>
                         <td>[% collectionItemsLoo.itemcallnumber | html %]</td>
                         <td>[% collectionItemsLoo.barcode | html %]</td>
-                        <td><a href="/cgi-bin/koha/rotating_collections/addItems.pl?colId=[% colId | uri %]&amp;barcode=[% collectionItemsLoo.barcode | uri %]&amp;removeItem=1&amp;action=addItem">Remove</a></td>
+                        <td>
+                            <form action="/cgi-bin/koha/rotating_collections/addItems.pl" method="post">
+                                [% INCLUDE 'csrf-token.inc' %]
+                                <input type="hidden" name="op" value="cud-add" />
+                                <input type="hidden" name="colId" value="[% colId | html %]" />
+                                <input type="hidden" name="barcode" value="[% collectionItemsLoo.barcode | html %]" />
+                                <input type="hidden" name="removeItem" value="1" />
+                                <button type="submit" class="btn btn-default btn-xs removeitem"><i class="fa fa-trash"></i> Remove</a>
+                            </form>
+                        </td>
                       </tr>
                     [% END %]
                   </table>
diff --git a/koha-tmpl/intranet-tmpl/prog/js/rotating-collections.js b/koha-tmpl/intranet-tmpl/prog/js/rotating-collections.js
index 5879ca917e..9031eb646b 100644
--- a/koha-tmpl/intranet-tmpl/prog/js/rotating-collections.js
+++ b/koha-tmpl/intranet-tmpl/prog/js/rotating-collections.js
@@ -4,8 +4,12 @@ $(document).ready(function(){
     $("#barcode").focus();
 
     $(".confirmdelete").click(function(){
+        return confirm( __("Are you sure you want to delete this rotating collection?"));
+    });
+
+    $(".removeitem").on("click", function(){
         $(this).parents('tr').addClass("warn");
-        if(confirm(__("Are you sure you want to delete this rotating collection?"))){
+        if(confirm(__("Are you sure you want to remove this item?"))){
             $(this).parents('form').submit();
             return true;
         } else {
-- 
2.39.5