gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 41043: Use op 'add_form' and 'edit_form' in oai servers 

Since CSRF protection, 'op' arg for creating/editing an object uses add_form and edit_form.
This is missing only in admin/oai_servers.pl

This patch also removes TT variable add_form to avoid confusion

Test plan :
1) Create a new OAI repository
2) Enter mandatory datas in form and save
3) Edit this repository
4) Copy this repository

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Fridolin Somers 2025-10-17 11:44:30 +02:00 committed by Lucas Gass
parent 9c9ba87468
commit d0cdf16a45
No known key found for this signature in database
GPG Key ID: 60B447398B0D36CA
2 changed files with 17 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
admin/oai_servers.pl
View File

@ -90,12 +90,13 @@ if ( $op eq 'cud-delete_confirmed' && $id ) {
# Now list multiple records, or edit one record # Now list multiple records, or edit one record
my $data = []; my $data = [];
if ( $op eq 'add' || $op eq 'edit' ) { if ( $op eq 'add_form' || $op eq 'edit_form' ) {
$data = server_search( $schema, $id, $searchfield ) if $searchfield || $id; $data = server_search( $schema, $id, $searchfield ) if $searchfield || $id;
delete $data->[0]->{id} if @$data && $op eq 'add'; #cloning record delete $data->[0]->{id} if @$data && $op eq 'add_form'; #cloning record
$template->param( $template->param(
add_form => 1, server => @$data ? $data->[0] : undef, server => @$data ? $data->[0] : undef,
op => $op, type => $op eq 'add' ? lc $type : '' op => $op,
type => ( $op eq 'add_form' ) ? lc $type : ''
); );
} else { } else {
$data = server_search( $schema, $id, $searchfield ); $data = server_search( $schema, $id, $searchfield );

24
koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_servers.tt
View File

@ -7,11 +7,11 @@
[% PROCESS 'i18n.inc' %] [% PROCESS 'i18n.inc' %]
<title> <title>
[% IF op == 'edit' %] [% IF op == 'edit_form' %]
Modify OAI repository [% server.servername | html %] &rsaquo; Modify OAI repository [% server.servername | html %] &rsaquo;
[% END %] [% END %]
[% IF op == 'add' %] [% IF op == 'add_form' %]
New OAI repository &rsaquo; New OAI repository &rsaquo;
[% END %] [% END %]
OAI repositories &rsaquo; Administration &rsaquo; Koha OAI repositories &rsaquo; Administration &rsaquo; Koha
@ -30,17 +30,17 @@
<a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a>
[% END %] [% END %]
[% IF op == 'edit' || op == 'add' %] [% IF op == 'edit_form' || op == 'add_form' %]
[% WRAPPER breadcrumb_item %] [% WRAPPER breadcrumb_item %]
<a href="/cgi-bin/koha/admin/oai_servers.pl">OAI repositories</a> <a href="/cgi-bin/koha/admin/oai_servers.pl">OAI repositories</a>
[% END %] [% END %]
[% END %] [% END %]
[% IF op == 'edit' %] [% IF op == 'edit_form' %]
[% WRAPPER breadcrumb_item bc_active= 1 %] [% WRAPPER breadcrumb_item bc_active= 1 %]
<span>Modify OAI repository [% server.servername | html %]</span> <span>Modify OAI repository [% server.servername | html %]</span>
[% END %] [% END %]
[% ELSIF op == 'add' %] [% ELSIF op == 'add_form' %]
[% WRAPPER breadcrumb_item bc_active= 1 %] [% WRAPPER breadcrumb_item bc_active= 1 %]
<span>New OAI repository</span> <span>New OAI repository</span>
[% END %] [% END %]
@ -64,10 +64,10 @@
<div class="alert alert-warning">Error: Server with ID [% msg_add | html %] not found</div> <div class="alert alert-warning">Error: Server with ID [% msg_add | html %] not found</div>
[% END %] [% END %]
[% IF ( add_form ) %] [% IF op == 'edit_form' || op == 'add_form' %]
<form action="/cgi-bin/koha/admin/oai_servers.pl" name="Aform" method="post" id="serverentry"> <form action="/cgi-bin/koha/admin/oai_servers.pl" name="Aform" method="post" id="serverentry">
[% INCLUDE 'csrf-token.inc' %] [% INCLUDE 'csrf-token.inc' %]
[% IF op == 'edit' %] [% IF op == 'edit_form' %]
<h1>Modify OAI repository</h1> <h1>Modify OAI repository</h1>
<input type="hidden" name="id" value="[% server.oai_server_id | html %]" /> <input type="hidden" name="id" value="[% server.oai_server_id | html %]" />
[% ELSE %] [% ELSE %]
@ -121,7 +121,7 @@
[% IF op == 'list' %] [% IF op == 'list' %]
<div id="toolbar" class="btn-toolbar"> <div id="toolbar" class="btn-toolbar">
<a id="newserver" class="btn btn-default" href="/cgi-bin/koha/admin/oai_servers.pl?op=add"><i class="fa fa-plus"></i> New OAI repository</a> <a id="newserver" class="btn btn-default" href="/cgi-bin/koha/admin/oai_servers.pl?op=add_form"><i class="fa fa-plus"></i> New OAI repository</a>
</div> </div>
<h1>OAI repositories</h1> <h1>OAI repositories</h1>
[% IF id %] [% IF id %]
@ -139,7 +139,7 @@
[% FOREACH loo IN loop %] [% FOREACH loo IN loop %]
<tr> <tr>
<td>[% loo.oai_server_id | html %]</td> <td>[% loo.oai_server_id | html %]</td>
<td><a href="/cgi-bin/koha/admin/oai_servers.pl?op=edit&amp;id=[% loo.oai_server_id | uri %]">[% loo.servername | html %]</a></td <td><a href="/cgi-bin/koha/admin/oai_servers.pl?op=edit_form&amp;id=[% loo.oai_server_id | uri %]">[% loo.servername | html %]</a></td
><td>[% loo.endpoint | html %]</td><td>[% loo.oai_set | html %]</td> ><td>[% loo.endpoint | html %]</td><td>[% loo.oai_set | html %]</td>
<td>[% loo.dataformat | html %]</td> <td>[% loo.dataformat | html %]</td>
<td <td
@ -154,10 +154,10 @@
<a class="btn btn-default btn-xs dropdown-toggle" id="reportactions[% savedreport.id | html %]" role="button" data-bs-toggle="dropdown" href="#"> Actions </a> <a class="btn btn-default btn-xs dropdown-toggle" id="reportactions[% savedreport.id | html %]" role="button" data-bs-toggle="dropdown" href="#"> Actions </a>
<ul class="dropdown-menu pull-right" role="menu" aria-labelledby="reportactions[% savedreport.id | html %]"> <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="reportactions[% savedreport.id | html %]">
<li <li
><a class="dropdown-item" href="/cgi-bin/koha/admin/oai_servers.pl?op=edit&amp;id=[% loo.oai_server_id | uri %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a></li ><a class="dropdown-item" href="/cgi-bin/koha/admin/oai_servers.pl?op=edit_form&amp;id=[% loo.oai_server_id | uri %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a></li
> >
<li <li
><a class="dropdown-item" href="/cgi-bin/koha/admin/oai_servers.pl?op=add&amp;id=[% loo.oai_server_id | uri %]"><i class="fa fa-copy"></i> Copy</a></li ><a class="dropdown-item" href="/cgi-bin/koha/admin/oai_servers.pl?op=add_form&amp;id=[% loo.oai_server_id | uri %]"><i class="fa fa-copy"></i> Copy</a></li
> >
<li> <li>
<a href="#" class="dropdown-item delete" data-formid="server_row_[% loo.oai_server_id | uri %]" data-servername="[% loo.servername | html %]"><i class="fa fa-trash-can"></i> Delete</a> <a href="#" class="dropdown-item delete" data-formid="server_row_[% loo.oai_server_id | uri %]" data-servername="[% loo.servername | html %]"><i class="fa fa-trash-can"></i> Delete</a>
@ -185,7 +185,7 @@
[% INCLUDE 'datatables.inc' %] [% INCLUDE 'datatables.inc' %]
[% END %] [% END %]
<script> <script>
[% IF ( add_form ) %] [% IF op == 'edit_form' || op == 'add_form' %]
$(document).ready(function(){ $(document).ready(function(){
// Update selects for dataformat and recordtype // Update selects for dataformat and recordtype
[% IF server %] [% IF server %]