From 8596861127b9a7e98436971b4f347323b373a7eb Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Fri, 4 Aug 2023 10:57:42 +0200
Subject: [PATCH] Bug 34478: Replace csrf_token input with include file -
 manual

A couple of left not caught by the previous regex

Still TODO:
% git grep csrf_token **/*.inc **/*.tt
still shows example that needs to be replaced, later (because we use GET)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
---
 koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc      | 2 +-
 koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
index 9cd8271a34..b24219748c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
@@ -222,7 +222,7 @@
                         <label for="uploadfile">Select the file to upload: </label>
                         <input type="file" id="uploadfile" name="uploadfile" required="required" />
                         <div class="action">
-                            <input type="hidden" id="csrf_token" name="csrf_token" value="[% csrf_token | html %]" />
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" id="image" name="filetype" value="image" />
                             <input type="hidden" id="cardnumber" name="cardnumber" value="[% patron.cardnumber | html %]" />
                             <input type="hidden" id="borrowernumber" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt
index aa4d6d9760..864bdcf8b3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt
@@ -786,7 +786,7 @@
                                 <div id="addcomment" class="content_hidden">
                                     <form class="validated" method="post" action="/cgi-bin/koha/ill/ill-requests.pl">
                                         <input type="hidden" value="save_comment" name="method">
-                                        <input type="hidden" value="[% csrf_token | html %]" name="csrf_token">
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="hidden" value="[% request.illrequest_id | html %]" name="illrequest_id">
                                         <fieldset class="rows">
                                             <ol>
-- 
2.20.1