From 8f1fff8b703132be9fecf8dec1b55feb3717b4a0 Mon Sep 17 00:00:00 2001
From: Lucas Gass <lucas@bywatersolutions.com>
Date: Fri, 22 Aug 2025 19:49:52 +0000
Subject: [PATCH] Bug 38967: Make exportItems use POST

To test:
1. Go to item search.
2. Enter parameters that retrieve more than 500 items.
3. From the item search results page, show All entries, then "Select visible rows."
4. Select either Export selected results to CSV or Barcode file.
5. A resulting error message of either "This site can't be reached. The connection was reset" or a 400 Bad request page with a URL with all the item numbers inserted appears.
6. APPLY PATCH
Try steps 1 - 4 again, this time it should export.

Signed-off-by: Eric Garcia <cubingguy714@gmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
---
 .../prog/en/modules/catalogue/itemsearch.tt   | 20 +++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt
index 8114931675..e25680d088 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt
@@ -437,11 +437,23 @@
         }
 
         function exportItems(format) {
-            let item_search_selections = JSON.parse( localStorage.getItem("item_search_selections") ) || [];
+            let item_search_selections = JSON.parse(localStorage.getItem("item_search_selections")) || [];
             if (item_search_selections.length > 0) {
-            var href = '/cgi-bin/koha/catalogue/item-export.pl?format=' + format;
-                href += '&itemnumber=' + Array.from( item_search_selections ).join('&itemnumber=');
-                location = href;
+                let inputs = item_search_selections.map(itemnumber =>
+                    `<input type="hidden" name="itemnumber" value="${itemnumber}">`
+                ).join('');
+
+                let form = $(`
+                    <form method="POST" action="/cgi-bin/koha/catalogue/item-export.pl">
+                        [% INCLUDE 'csrf-token.inc' %]
+                        <input type="hidden" name="format" value="${format}">
+                        ${inputs}
+                    </form>
+                `);
+
+                $('body').append(form);
+                form.submit();
+                form.remove();
             } else {
                 $('#format-' + format).prop('checked', true);
                 $('#itemsearchform').submit();