From d4c114453ff73a5dbbca1330b458a55dbf1bacb6 Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Date: Thu, 25 Jul 2024 10:54:36 +0100
Subject: [PATCH] Bug 37374: (follow-up) Add csrf token and op to form

This patch adds a hidden op input and csrf token to the clubs hold
request form.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 83966f4273093dc2d31f13a81ed563c2d5b16dd6)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
---
 koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt
index 457708dfd4..1568430954 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt
@@ -303,6 +303,8 @@
                 <fieldset class="rows">
                     <legend>Hold details</legend>
                     <form action="/api/v1/clubs/[% club.id | html %]/holds" method="post" name="form" id="club-request-form">
+                        [% INCLUDE 'csrf-token.inc' %]
+                        <input type="hidden" name="op" value="cud-noop" />
 
                         [% IF ( multi_hold ) %]
                             <input type="hidden" name="request" value="any"/>
-- 
2.39.5