https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42383 --- Comment #63 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 209614 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=209614&action=edit Bug 42383: (QA follow-up) Do not check in items from the barcode URL param The check-in page kept the legacy ?barcode= deep link working by submitting a check-in for it on page load. That turns a GET request into a state change: any link or embedded resource pointing at circ/checkin.pl?barcode=XXX checks the item in for the logged in staff user. The legacy page required a CSRF protected POST (op=cud-checkin). This patch (QA comment point 3) makes the page only prefill the barcode input with the parameter value and focus it. Staff need to press 'Check in' (or Enter) to actually check the item in. A setBarcode() method is added to the BarcodeInput component for this. Test plan: 1. Check out an item to a patron 2. Visit /cgi-bin/koha/circ/checkin.pl?barcode=<the item barcode> => FAIL: The item is checked in on page load 3. Check the item out again 4. Apply this patch and rebuild: $ ktd --shell k$ yarn js:build k$ restart_all 5. Repeat step 2 => SUCCESS: The barcode input contains the barcode and has the focus => SUCCESS: Nothing is checked in, the item is still checked out 6. Press Enter => SUCCESS: The item is checked in 7. Sign off :-D Assisted-by: Opus 5.5 (Anthropic) -- You are receiving this mail because: You are watching all bug changes.