From 561b8cdacbb607cf27f2e20d3bc770d0eb66019a Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <phil@chetcolibrary.org>
Date: Fri, 8 Nov 2024 14:08:18 -0800
Subject: [PATCH] Bug 38378: Serial frequency deletion needs to be converted to
 POST from GET

Deleting a serial frequency is (or can be) a two step process. If you are
deleting a frequency which is in use, you get back a page warning you that it
is in use, which the CSRF changes converted to a form POSTing with a CSRF
token and the new op cud-del. However, to get there you have to go through
the step that's the only step if the frequency isn't in use, clicking a link
that still thinks the op is named del rather than cud-del. That link needs to
instead be a form with a CSRF token and a POST of cud-del.

Test plan:
 1. Without the patch, Serials - Manage frequencies
 2. For any frequency, click Delete, click OK in the confirmation popup
 3. Nothing happened except your URL changing, the frequency is still there
 4. Apply patch, reload Manage frequencies
 5. For any frequency, click Delete, click OK in the confirmation popup
 6. This time, your frequency was deleted

Sponsored-by: Chetco Community Public Library
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit be6e13b50cd9d4e4b638ddae259a9b5c8ba9c5a7)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
---
 .../prog/en/modules/serials/subscription-frequencies.tt    | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt
index 8f44f015d5..dedc1fe938 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt
@@ -184,7 +184,12 @@
                                 <td>[% frequency.displayorder | html %]</td>
                                 <td class="actions">
                                     <a class="btn btn-default btn-xs" href="/cgi-bin/koha/serials/subscription-frequencies.pl?op=modify&frequencyid=[% frequency.id | html %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a>
-                                    <a class="delete_frequency btn btn-default btn-xs" href="/cgi-bin/koha/serials/subscription-frequencies.pl?op=del&frequencyid=[% frequency.id | html %]"><i class="fa fa-trash-can"></i> Delete</a>
+                                    <form action="/cgi-bin/koha/serials/subscription-frequencies.pl" method="post">
+                                        [% INCLUDE 'csrf-token.inc' %]
+                                        <input type="hidden" name="op" value="cud-del" />
+                                        <input type="hidden" name="frequencyid" value="[% frequency.id | html %]" />
+                                        <button class="delete_frequency btn btn-default btn-xs"><i class="fa fa-trash-can"></i> Delete</button>
+                                    </form>
                                 </td>
                             </tr>
                         [% END %]