https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39570 Bug ID: 39570 Summary: Add item form includes itemnumber while adding a new item Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Cataloging Assignee: koha-bugs@lists.koha-community.org Reporter: phil@chetcolibrary.org QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl Depends on: 36192 Luckily, submitting an itemnumber that's either empty or bogus while adding a new item doesn't actually do anything since the code for op == 'cud-additem' doesn't ever look at itemnumber, but it's confusing and scary looking in the case where you add an item after editing an existing item. The template looks at [% IF op != 'add_item' %] to decide to add the <input type="hidden" name="itemnumber" value="[% itemnumber | html %]" />. Prior to the bug 36192 CSRF protection, that worked, but now the op for adding an item is cud-additem, so it's always true and we always submit an itemnumber. And without bug 27625 it would have been less scary looking, since before then while processing the editing of an item we cleared $itemnumber after we were done using it, so it at least would have been value="". Now, if you edit an existing item and then add another, the form you submit to add an item includes the itemnumber of the item you previously edited. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.