From 78bcbf52f727f6f3d22eb63933b6952d968a35d3 Mon Sep 17 00:00:00 2001
From: Owen Leonard <oleonard@myacpl.org>
Date: Tue, 20 Feb 2024 15:49:41 +0000
Subject: [PATCH] Bug 34478: Convert patron file delete link to a posted form

This patch modifies the patron file template to convert the "Delete"
link to a form which includes the CSRF token. The script has already
been modified to check for the "op" value updated in the template.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
---
 .../intranet-tmpl/prog/en/modules/members/files.tt   | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt
index 1756b41371..d3a887fa38 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt
@@ -70,7 +70,17 @@
                                         <td>[% f.file_type | html %]</td>
                                         <td>[% f.file_description | html %]</td>
                                         <td>[% f.date_uploaded | $KohaDates %]</td>
-                                        [% IF CAN_user_borrowers_edit_borrowers %]<td><a class="btn btn-default btn-xs confirmdelete" href="?borrowernumber=[% patron.borrowernumber | html %]&amp;op=delete&amp;file_id=[% f.file_id | html %]"><i class="fa fa-trash-can"></i> Delete</a></td>[% END %]
+                                        [% IF CAN_user_borrowers_edit_borrowers %]
+                                            <td>
+                                                <form action="files.pl" method="post">
+                                                    [% INCLUDE 'csrf-token.inc' %]
+                                                    <input type="hidden" name="op" value="cud-delete" />
+                                                    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
+                                                    <input type="hidden" name="file_id" value="[% f.file_id | html %]" />
+                                                    <button class="btn btn-default btn-xs confirmdelete"><i class="fa fa-trash-can"></i> Delete</button>
+                                                </form>
+                                            </td>
+                                        [% END %]
                                     </tr>
                                 [% END %]
                             </tbody>
-- 
2.39.5