From e7019264429b90cc4e7d315f7aa600a23fec984a Mon Sep 17 00:00:00 2001
From: Nick Clemens <nick@bywatersolutions.com>
Date: Wed, 13 Mar 2024 10:52:28 +0000
Subject: [PATCH] Bug 36190: Fix problems found by test

opac-shelves           - forms were stateless - changed to GET
sco-main               - forms stateless - changed to GET
                         ** untested because sco + auth is broken
smart-rules.tt         - JS form template - added placeholder 'cud-' op
ill-requests           - added cud- tp ops
                         ** tested comments, but not checkout, simple changes
boraccount             - removed repeated op - updated script
patroncards/edit-batch - add placeholder 'cud-' op
patroncards/manage     - add placheholder 'cud-' op
elasticsearch/mappings - separate forms - this could use a style follow-up, but makes more sense separate I think
reports/dictionary      - stateless - changed to GET
guided_reports_start    - stateless - changed to GET
suggestion/suggestion   - add placeholder 'cud-' op
inventory               - filed bug 36305, needs more handling

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
---
 admin/searchengine/elasticsearch/mappings.pl           |  2 +-
 ill/ill-requests.pl                                    |  4 ++--
 .../admin/searchengine/elasticsearch/mappings.tt       | 10 +++++++---
 .../intranet-tmpl/prog/en/modules/admin/smart-rules.tt |  3 ++-
 .../intranet-tmpl/prog/en/modules/ill/ill-requests.tt  |  4 ++--
 .../prog/en/modules/members/boraccount.tt              |  5 +----
 .../prog/en/modules/patroncards/edit-batch.tt          |  4 ++--
 .../prog/en/modules/patroncards/manage.tt              |  2 +-
 .../prog/en/modules/reports/dictionary.tt              |  3 +--
 .../prog/en/modules/reports/guided_reports_start.tt    |  3 +--
 .../prog/en/modules/suggestion/suggestion.tt           |  4 ++--
 .../opac-tmpl/bootstrap/en/modules/opac-shelves.tt     |  6 ++----
 .../opac-tmpl/bootstrap/en/modules/sco/sco-main.tt     |  6 ++----
 members/boraccount.pl                                  |  2 +-
 14 files changed, 27 insertions(+), 31 deletions(-)

diff --git a/admin/searchengine/elasticsearch/mappings.pl b/admin/searchengine/elasticsearch/mappings.pl
index 1c0b26a50c..dc2fa3149e 100755
--- a/admin/searchengine/elasticsearch/mappings.pl
+++ b/admin/searchengine/elasticsearch/mappings.pl
@@ -86,7 +86,7 @@ while ( my ( $key, $value ) = each(%{Koha::SearchEngine::Elasticsearch::QueryBui
     $search_fields_aliases->{$value} = $field_aliases;
 }
 
-if ( $op eq 'edit' ) {
+if ( $op eq 'cud-edit' ) {
 
     $schema->storage->txn_begin;
 
diff --git a/ill/ill-requests.pl b/ill/ill-requests.pl
index 8dc24d5842..2c70d1ca06 100755
--- a/ill/ill-requests.pl
+++ b/ill/ill-requests.pl
@@ -368,7 +368,7 @@ if ( $backends_available ) {
 
         # handle special commit rules & update type
         handle_commit_maybe($backend_result, $request);
-    } elsif ( $op eq 'check_out') {
+    } elsif ( $op eq 'cud-check_out') {
         my $request = Koha::Illrequests->find($params->{illrequest_id});
         my $backend_result = $request->check_out($params);
         $template->param(
@@ -409,7 +409,7 @@ if ( $backends_available ) {
             }
         }
 
-    } elsif ( $op eq "save_comment" ) {
+    } elsif ( $op eq "cud-save_comment" ) {
         my $comment = Koha::Illcomment->new({
             illrequest_id  => scalar $params->{illrequest_id},
             borrowernumber => $patronnumber,
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/searchengine/elasticsearch/mappings.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/searchengine/elasticsearch/mappings.tt
index 3ade4c3c1e..625afa4998 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/searchengine/elasticsearch/mappings.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/searchengine/elasticsearch/mappings.tt
@@ -96,8 +96,7 @@ a.add, a.delete {
                 <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, reset mappings</button>
             </form>
 
-            <form method="post">
-                [% INCLUDE 'csrf-token.inc' %]
+            <form method="get">
                 <button type="submit" class="deny"><i class="fa fa-fw fa-times"></i> No, do not reset mappings</button>
             </form>
         </div>
@@ -505,7 +504,12 @@ a.add, a.delete {
         [% END # /WRAPPER tabs %]
 
         <fieldset class="action">
-            <button class="btn btn-primary" type="submit" name="op" value="cud-edit"><i class="fa-solid fa-hard-drive" aria-hidden="true"></i> Save</button>
+            <input type="hidden" name="op" value="cud-edit">
+            <button class="btn btn-primary" type="submit"><i class="fa-solid fa-hard-drive" aria-hidden="true"></i> Save</button>
+        </fieldset>
+    </form>
+    <form method="get">
+        <fieldset class="action">
             <button class="btn btn-default" type="submit" name="op" value="reset_confirm"><i class="fa-solid fa-rotate" aria-hidden="true"></i> Reset mappings</button>
         </fieldset>
     </form>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt
index 5df0fd9d74..f536ef9760 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt
@@ -1417,9 +1417,10 @@
                         </table>
                     </form>
 
+                    <!-- This is a placeholder form to be filled by JS functions attached to buttons/links -->
                     <form id="delete_form" action="/cgi-bin/koha/admin/smart-rules.pl" method="post">
                         [% INCLUDE 'csrf-token.inc' %]
-                        <input type="hidden" name="op" value="" />
+                        <input type="hidden" name="op" value="cud-" />
                         <input type="hidden" name="itemtype" value="" />
                         <input type="hidden" name="categorycode" value="" />
                         <input type="hidden" name="branch" value="" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt
index 341715b52f..e7b2f20e59 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt
@@ -265,7 +265,7 @@
                                     </ol>
                                 </fieldset>
                                 <fieldset class="action">
-                                    <input type="hidden" value="check_out" name="op">
+                                    <input type="hidden" value="cud-check_out" name="op">
                                     <input type="hidden" value="form" name="stage">
                                     [% IF items.size == 1 %]
                                         <input name="branchcode" type="hidden" value="[% branchcode | html %]">
@@ -789,7 +789,7 @@
                                 <h3><a id="toggle_addcomment" href="#">Add comment</a></h3>
                                 <div id="addcomment" class="content_hidden">
                                     <form class="validated" method="post" action="/cgi-bin/koha/ill/ill-requests.pl">
-                                        <input type="hidden" value="save_comment" name="op">
+                                        <input type="hidden" value="cud-save_comment" name="op">
                                         [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" value="[% request.illrequest_id | html %]" name="illrequest_id">
                                         <fieldset class="rows">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt
index 5eb037b659..a051fc2732 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt
@@ -244,7 +244,7 @@
 
     <!-- Issue payout modal -->
     <div class="modal" id="issuePayoutModal" tabindex="-1" role="dialog" aria-labelledby="issuePayoutLabel">
-        <form  id="payout_form" action="/cgi-bin/koha/members/boraccount.pl" method="post" enctype="multipart/form-data" class="validated">
+        <form id="payout_form" action="/cgi-bin/koha/members/boraccount.pl" method="post" enctype="multipart/form-data" class="validated">
             [% INCLUDE 'csrf-token.inc' %]
             <input type="hidden" name="accountlines_id" value="" id="payoutline">
             <input type="hidden" name="op" value="cud-payout">
@@ -288,7 +288,6 @@
                         </fieldset> <!-- /.rows -->
                     </div> <!-- /.modal-body -->
                     <div class="modal-footer">
-                        <input type="hidden" name="op" value="payout">
                         <button type="submit" class="btn btn-default" id="borr_payout_confirm">Confirm</button>
                         <button type="button" class="btn btn-default" data-dismiss="modal">Cancel</button>
                     </div> <!-- /.modal-footer -->
@@ -346,7 +345,6 @@
                         </fieldset> <!-- /.rows -->
                     </div> <!-- /.modal-body -->
                     <div class="modal-footer">
-                        <input type="hidden" name="op" value="refund">
                         <button type="submit" class="btn btn-default" id="borr_refund_confirm">Confirm</button>
                         <button type="button" class="btn btn-default" data-dismiss="modal">Cancel</button>
                     </div> <!-- /.modal-footer -->
@@ -386,7 +384,6 @@
                         </fieldset> <!-- /.rows -->
                     </div> <!-- /.modal-body -->
                     <div class="modal-footer">
-                        <input type="hidden" name="op" value="discount">
                         <button type="submit" class="btn btn-default">Confirm</button>
                         <button type="button" class="btn btn-default" data-dismiss="modal">Cancel</button>
                     </div> <!-- /.modal-footer -->
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-batch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-batch.tt
index de6bb89c76..cd932afff5 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-batch.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-batch.tt
@@ -144,13 +144,13 @@
                             </form>
                             <form id="patron_form" action="/cgi-bin/koha/patroncards/edit-batch.pl" method="post">
                                 [% INCLUDE 'csrf-token.inc' %]
-                                <input type="hidden" name="op" value="" />
+                                <input type="hidden" name="op" value="cud-" />
                                 <input type="hidden" name="batch_id" value="" />
                                 <input type="hidden" name="label_id" value="" />
                             </form>
                             <form id="batch_form" action="/cgi-bin/koha/patroncards/manage.pl" method="post">
                                 [% INCLUDE 'csrf-token.inc' %]
-                                <input type="hidden" name="op" value="" />
+                                <input type="hidden" name="op" value="cud-" />
                             </form>
                             [% ELSE %]
                                 <fieldset class="rows" style="border-bottom: 0px; border: 0px;">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/manage.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/manage.tt
index d9978b45b3..f92069a124 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/manage.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/manage.tt
@@ -144,7 +144,7 @@
                             </form>
                             <form id="manage_form" method="post" action="/cgi-bin/koha/patroncards/manage.pl">
                                 [% INCLUDE 'csrf-token.inc' %]
-                                <input type="hidden" name="op" value="" />
+                                <input type="hidden" name="op" value="cud-" />
                             </form>
 
                             [% ELSE %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tt
index 623554ba2f..facf3987be 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tt
@@ -87,8 +87,7 @@
 		[% IF ( definitions ) %]
             <div class="page-section">
                 <h2>Current terms</h2>
-                <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">
-                    [% INCLUDE 'csrf-token.inc' %]
+                <form action="/cgi-bin/koha/reports/dictionary.pl" method="get">
                     <input type="hidden" name="op" value="list" />
                     [% IF ( areas ) %]
                         Filter by area
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
index 1682c2a103..09602bec19 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
@@ -1418,8 +1418,7 @@
                 [% END # /IF ( editsql ) %]
 
                 [% IF ( errors ) %]
-                    <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
-                        [% INCLUDE 'csrf-token.inc' %]
+                    <form action="/cgi-bin/koha/reports/guided_reports.pl" method="get">
                         <div class="dialog alert">
                             <strong>The following error was encountered:</strong><br />
                             [% FOREACH error IN errors %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
index da321ebb7b..c3d3a45322 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
@@ -722,12 +722,12 @@
                         [% WRAPPER tab_panel tabname= suggestion.suggestiontype %]
                             <form id="action_form" method="post" action="/cgi-bin/koha/suggestion/suggestion.pl">
                                 [% INCLUDE 'csrf-token.inc' %]
-                                <input type="hidden" name="op" value="" />[%# filled by click event %]
+                                <input type="hidden" name="op" value="cud-" />[%# filled by click event %]
                                 <input type="hidden" name="suggestionid" value="" />
                             </form>
                             <form class="update_suggestions" method="post" action="/cgi-bin/koha/suggestion/suggestion.pl#[% suggestion.suggestiontype| uri %]">
                                 [% INCLUDE 'csrf-token.inc' %]
-                                <input type="hidden" name="op" value="" />[%# filled by submit %]
+                                <input type="hidden" name="op" value="cud-" />[%# filled by submit %]
 
                                 [% IF suggestion.suggestions.size %]
                                     <p>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
index d96774390d..6fae1507be 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
@@ -245,8 +245,7 @@
 
                                         [% IF can_manage_shelf %]
                                             <span class="sep">|</span>
-                                            <form method="post" action="/cgi-bin/koha/opac-shelves.pl" class="d-inline">
-                                                [% INCLUDE 'csrf-token.inc' %]
+                                            <form method="get" action="/cgi-bin/koha/opac-shelves.pl" class="d-inline">
                                                 <input type="hidden" name="op" value="edit_form" />
                                                 <input type="hidden" name="referer" value="view" />
                                                 <input type='hidden' name='public' value='[% shelf.public | html %]' />
@@ -554,8 +553,7 @@
                                     <a class="btn btn-link newshelf" href="/cgi-bin/koha/opac-shelves.pl?op=add_form"><i class="fa fa-fw fa-plus" aria-hidden="true"></i> New list</a>
                                     [% IF can_manage_shelf %]
                                         <span class="sep">|</span>
-                                        <form method="post" action="/cgi-bin/koha/opac-shelves.pl" class="d-inline">
-                                            [% INCLUDE 'csrf-token.inc' %]
+                                        <form method="get" action="/cgi-bin/koha/opac-shelves.pl" class="d-inline">
                                             <input type="hidden" name="op" value="edit_form" />
                                             <input type="hidden" name="referer" value="view" />
                                             <input type="hidden" name="public" value="[% shelf.public | html %]" />
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
index adbb4f0d94..7508a211b5 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
@@ -115,8 +115,7 @@
                                 </form>
                             [% END %]
 
-                            <form action="/cgi-bin/koha/sco/sco-main.pl" name="errorForm" class="inline" method="post">
-                                [% INCLUDE 'csrf-token.inc' %]
+                            <form action="/cgi-bin/koha/sco/sco-main.pl" name="errorForm" class="inline" method="get">
                                 <legend class="sr-only">Error</legend>
                                 <input type="hidden" name="op" value="" />
                                 <input type="hidden" name="patronid" value="[% patronid | html %]" />
@@ -175,8 +174,7 @@
                                 </form>
                             [% END %]
 
-                            <form action="/cgi-bin/koha/sco/sco-main.pl" name="confirmForm" class="inline" method="post">
-                                [% INCLUDE 'csrf-token.inc' %]
+                            <form action="/cgi-bin/koha/sco/sco-main.pl" name="confirmForm" class="inline" method="get">
                                 <legend class="sr-only">Cancel</legend>
                                 <input type="hidden" name="op" value="" />
                                 <input type="hidden" name="patronid" value="[% patronid | html %]" />
diff --git a/members/boraccount.pl b/members/boraccount.pl
index f629ef5605..707dc4b279 100755
--- a/members/boraccount.pl
+++ b/members/boraccount.pl
@@ -156,7 +156,7 @@ if ( $op eq 'cud-refund' ) {
     );
 }
 
-if ( $op eq 'discount' ) {
+if ( $op eq 'cud-discount' ) {
     output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
     my $charge_id        = scalar $input->param('accountlines_id');
     my $charge           = Koha::Account::Lines->find($charge_id);
-- 
2.39.5