From a019e78f4b681b3336c2bbe18245c65385dae70c Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Tue, 10 Feb 2026 21:14:57 +0100
Subject: [PATCH] Bug 41812: Adjust find-missing-csrf.t test to ignore csrf
 input from JS

This code injected the csrf token using the TT include file, that made
pass xt/find-missing-csrf.t

This bug removed the TT tags from the script tags, and we now need to
use a JS variable and retrieve the csrf token from the meta tag.

This patch suggests to adjust the script to ignore this case. We could
also rewrite the whole JS code and use built the HTML elements using
vanilla JS but that's for another day...

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
---
 xt/find-missing-csrf.t | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/xt/find-missing-csrf.t b/xt/find-missing-csrf.t
index dd229e6eed..5e08fce88d 100755
--- a/xt/find-missing-csrf.t
+++ b/xt/find-missing-csrf.t
@@ -50,7 +50,9 @@ sub check_csrf_in_forms {
     for my $line (@lines) {
         $line_number++;
         $open = $line_number if $line =~ m{<form.*method=('|")post('|")}i;
-        $found++ if $open && $line =~ m{csrf-token\.inc};
+        $found++
+            if $open && $line =~ m{csrf-token\.inc}
+            || $line =~ m{<input type="hidden" name="csrf_token" value="\$\{csrf_token\}" />};
         if ( $open && $line =~ m{</form} ) {
             push @errors, $open unless $found;
             $found = 0;