From 87d12dbe3c57a5f1fb105cdb40eda4c4cf2a3643 Mon Sep 17 00:00:00 2001
From: Owen Leonard <oleonard@myacpl.org>
Date: Tue, 20 Feb 2024 19:26:56 +0000
Subject: [PATCH] Bug 34478: Comment deletion should be POSTed form

This patch updates the "Delete" button on the comments moderation page
to convert the GET link to a posted form.

Unrelated: The JavaScript has also been modified so that it asks for
confirmation.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
---
 .../prog/en/modules/reviews/reviewswaiting.tt      | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reviews/reviewswaiting.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reviews/reviewswaiting.tt
index 56321b5ec0..536ab93cc2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reviews/reviewswaiting.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reviews/reviewswaiting.tt
@@ -98,7 +98,12 @@
         </td>
         <td class="actions">
             [% IF ( status ) %]<a href="/cgi-bin/koha/reviews/reviewswaiting.pl?op=unapprove&amp;reviewid=[% review.reviewid | uri %]" class="btn btn-default btn-xs"><i class="fa fa-times"></i> Unapprove</a>[% ELSE %]<a href="/cgi-bin/koha/reviews/reviewswaiting.pl?op=approve&amp;reviewid=[% review.reviewid | uri %]" class="btn btn-default btn-xs"><i class="fa fa-check"></i> Approve</a>[% END %]
-            <a href="/cgi-bin/koha/reviews/reviewswaiting.pl?op=delete&amp;reviewid=[% review.reviewid | uri %]" class="btn btn-default btn-xs"><i class="fa fa-trash-can" aria-hidden="true"></i> Delete</a>
+            <form action="/cgi-bin/koha/reviews/reviewswaiting.pl" method="post">
+                [% INCLUDE 'csrf-token.inc' %]
+                <input type="hidden" name="op" value="cud-delete" />
+                <input type="hidden" name="reviewid" value="[% review.reviewid | html %]" />
+                <button type="submit" class="btn btn-default btn-xs delete-comment"><i class="fa fa-trash-can" aria-hidden="true"></i> Delete</button>
+            </form>
         </td>
     </tr>
     [% END %]</tbody>
@@ -123,6 +128,13 @@
 
 [% MACRO jsinclude BLOCK %]
     [% Asset.js("js/tools-menu.js") | $raw %]
+    <script>
+        $(document).ready(function(){
+            $(".delete-comment").on("click", function(){
+                return confirm( _("Are you sure you want to delete this comment?") );
+            });
+        });
+    </script>
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
-- 
2.39.5