From 5a6b70efb13fcb52d7dfcb9fb015674ce0797ece Mon Sep 17 00:00:00 2001
From: Lucas Gass <lucas@bywatersolutions.com>
Date: Fri, 22 Sep 2023 18:25:21 +0000
Subject: [PATCH] Bug 34601: [22.05.x] Fix edit/delete links on suggestion.tt

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
---
 .../prog/en/modules/suggestion/suggestion.tt              | 8 ++++----
 suggestion/suggestion.pl                                  | 6 ++++++
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
index f993871af9..78e732fb47 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
@@ -112,8 +112,8 @@
                 <div class="col-md-8 col-md-offset-2">
 
                     <div id="toolbar" class="btn-toolbar">
-                        <a class="btn btn-default" id="editsuggestion" href="suggestion.pl?op=edit&amp;suggestionid=[% suggestionid | html %]"><i class="fa fa-pencil"></i> Edit</a>
-                        <a class="btn btn-default deletesuggestion" href="suggestion.pl?op=delete&amp;suggestionid=[% suggestionid | html %]"><i class="fa fa-trash"></i> Delete</a>
+                        <a class="btn btn-default" id="editsuggestion" href="suggestion.pl?op=edit&amp;csrf_token=[% csrf_token | html %]&amp;suggestionid=[% suggestionid | html %]"><i class="fa fa-pencil"></i> Edit</a>
+                        <a class="btn btn-default deletesuggestion" href="suggestion.pl?op=delete&amp;csrf_token=[% csrf_token | html %]&amp;suggestionid=[% suggestionid | html %]"><i class="fa fa-trash"></i> Delete</a>
                     </div>
 
                     <fieldset class="rows">
@@ -841,9 +841,9 @@
                                                 </td>
                                                 <td class="actions">
                                                     <div class="btn-group dropup">
-                                                        <a class="btn btn-default btn-xs" role="button" href="suggestion.pl?suggestionid=[% suggestions_loo.suggestionid | html %]&amp;op=edit"><i class="fa fa-pencil"></i> Edit</a><a class="btn btn-default btn-xs dropdown-toggle" id="more_actions_[% suggestions_loo.suggestionid | html %]" role="button" data-toggle="dropdown" href="#"><b class="caret"></b></a>
+                                                        <a class="btn btn-default btn-xs" role="button" href="suggestion.pl?suggestionid=[% suggestions_loo.suggestionid | html %]&amp;op=edit&amp;csrf_token=[% csrf_token | html %]"><i class="fa fa-pencil"></i> Edit</a><a class="btn btn-default btn-xs dropdown-toggle" id="more_actions_[% suggestions_loo.suggestionid | html %]" role="button" data-toggle="dropdown" href="#"><b class="caret"></b></a>
                                                         <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="more_actions_[% suggestions_loo.suggestionid | html %]">
-                                                            <li><a class="deletesuggestion" href="suggestion.pl?op=delete&amp;suggestionid=[% suggestions_loo.suggestionid | html %]"><i class="fa fa-trash"></i> Delete</a></li>
+                                                            <li><a class="deletesuggestion" href="suggestion.pl?op=delete&amp;csrf_token=[% csrf_token | html %]&amp;suggestionid=[% suggestions_loo.suggestionid | html %]"><i class="fa fa-trash"></i> Delete</a></li>
                                                             [% UNLESS suggestions_loo.archived %]
                                                                 <li><a class="archivesuggestion" href="suggestion.pl?op=archive&amp;suggestionid=[% suggestions_loo.suggestionid | html %]"><i class="fa fa-archive"></i> Archive</a></li>
                                                             [% ELSE %]
diff --git a/suggestion/suggestion.pl b/suggestion/suggestion.pl
index 8278a3f691..81d5f8d385 100755
--- a/suggestion/suggestion.pl
+++ b/suggestion/suggestion.pl
@@ -34,6 +34,7 @@ use Koha::Libraries;
 use Koha::Patrons;
 
 use URI::Escape qw( uri_escape );
+use Koha::Token;
 
 sub Init{
     my $suggestion= shift @_;
@@ -489,10 +490,15 @@ foreach my $field ( qw(managedby acceptedby suggestedby budgetid) ) {
     $hashlists{ lc($field) . "_loop" } = \@codes_list;
 }
 
+my $csrf_token = Koha::Token->new->generate_csrf({
+    session_id => scalar $input->cookie('CGISESSID'),
+});
+
 $template->param(
     %hashlists,
     borrowernumber           => ($input->param('borrowernumber') // undef),
     SuggestionStatuses       => GetAuthorisedValues('SUGGEST_STATUS'),
+    csrf_token               => $csrf_token,
 );
 output_html_with_http_headers $input, $cookie, $template->output;
 
-- 
2.39.5