From 6bc5b9fbce969075a923ae90c5c5833dc979877e Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Tue, 1 Aug 2023 09:12:10 +0200
Subject: [PATCH] Bug 34369: Pass csrf token from syspref API client (for Vue
 app)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 3c6dd02acbfc021c85b23e38d1ef605e09e65764)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
---
 .../prog/js/vue/fetch/system-preferences-api-client.js      | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/js/vue/fetch/system-preferences-api-client.js b/koha-tmpl/intranet-tmpl/prog/js/vue/fetch/system-preferences-api-client.js
index 9cfcabf08f..f37f3252ea 100644
--- a/koha-tmpl/intranet-tmpl/prog/js/vue/fetch/system-preferences-api-client.js
+++ b/koha-tmpl/intranet-tmpl/prog/js/vue/fetch/system-preferences-api-client.js
@@ -16,7 +16,11 @@ export class SysprefAPIClient extends HttpClient {
             update: (variable, value) =>
                 this.post({
                     endpoint: "",
-                    body: "pref_%s=%s".format(variable, value),
+                    body: "pref_%s=%s&csrf_token=%s".format(
+                        variable,
+                        value,
+                        csrf_token
+                    ),
                     headers: {
                         "Content-Type":
                             "application/x-www-form-urlencoded;charset=utf-8",
-- 
2.39.5