https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37206 --- Comment #1 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 168237 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168237&action=edit Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation This patch updates the label batch edit template so that removing a single or multiple items from a batch is a CSRF-protected POST operation. The patch also removes the existing "if ($op eq 'cud-delete') {" section of label-edit-batch.pl because it was unused. To test, apply the patch and go to Cataloging -> Labels. - Create a label batch and add multiple items to it. - From the list of label batches, click "Edit" on the batch you created. - Click the "Delete" button for one of the items in the batch. - If you confirm, the item should be deleted. - In the "Select" column, check multiple checkboxes. - Click the "Remove selected items" button in the toolbar. - Verify that confirming this operation results in the items being deleted from the batch. Sponsored-by: Athens County Public Libraries -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37206 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168237|0 |1 is obsolete| | --- Comment #2 from David Nind <david@davidnind.com> --- Created attachment 168288 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168288&action=edit Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation This patch updates the label batch edit template so that removing a single or multiple items from a batch is a CSRF-protected POST operation. The patch also removes the existing "if ($op eq 'cud-delete') {" section of label-edit-batch.pl because it was unused. To test, apply the patch and go to Cataloging -> Labels. - Create a label batch and add multiple items to it. - From the list of label batches, click "Edit" on the batch you created. - Click the "Delete" button for one of the items in the batch. - If you confirm, the item should be deleted. - In the "Select" column, check multiple checkboxes. - Click the "Remove selected items" button in the toolbar. - Verify that confirming this operation results in the items being deleted from the batch. Sponsored-by: Athens County Public Libraries Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37206 Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #168288|0 |1 is obsolete| | --- Comment #3 from Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> --- Created attachment 168341 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=168341&action=edit Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation This patch updates the label batch edit template so that removing a single or multiple items from a batch is a CSRF-protected POST operation. The patch also removes the existing "if ($op eq 'cud-delete') {" section of label-edit-batch.pl because it was unused. To test, apply the patch and go to Cataloging -> Labels. - Create a label batch and add multiple items to it. - From the list of label batches, click "Edit" on the batch you created. - Click the "Delete" button for one of the items in the batch. - If you confirm, the item should be deleted. - In the "Select" column, check multiple checkboxes. - Click the "Remove selected items" button in the toolbar. - Verify that confirming this operation results in the items being deleted from the batch. Sponsored-by: Athens County Public Libraries Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37206 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |24.11.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37206 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com Version(s)|24.11.00 |24.11.00,24.05.06 released in| | Status|Pushed to main |Pushed to stable --- Comment #5 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.06 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37206 Bug 37206 depends on bug 36192, which changed state. Bug 36192 Summary: [OMNIBUS] CSRF Protection for Koha https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.