Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity

Bug 29853: Add HTML filter before KohaSpan filter

Browse source 
Usage of Template Toolkit plugin KohaSpan as filter is actually :
  Group [% added.title | $KohaSpan class = 'name' | $raw %] created.

But KohaSpan filter does not escape HTML characters.
Whe should filter HTML then KohaSpan.

This patch adds TT html filter before KohaSpan.
Also replaces in Javascript html() with text()
to ensure special caracters are still encoded.
See https://api.jquery.com/text/

Test plan :
1) Create a library with name Libra'rie
2) Create a library group with name Grou'pe
3) Play with this group
4) Add library
5) Remove library
6) Edit group
7) Delete group
8) Each time check that &apos, is not interpreted as single quote

Signed-off-by: Solène Desvaux <solene.desvaux@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This commit is contained in:
Fridolin Somers 2022-01-11 19:40:35 -10:00
parent 2d9aec24d6
commit be18ee7aa5
1 changed files with 8 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
koha-tmpl/intranet-tmpl/prog/en/modules/admin/library_groups.tt
View file

@ -40,22 +40,22 @@
[% IF added %]
<div class="dialog message group-added">
[% IF added.branchcode %]
[% added.library.branchname | $KohaSpan class = 'name' | $raw %] added to group.
[% added.library.branchname | html | $KohaSpan class = 'name' %] added to group.
[% ELSE %]
Group [% added.title | $KohaSpan class = 'name' | $raw %] created.
Group [% added.title | html | $KohaSpan class = 'name' %] created.
[% END %]
</div>
[% ELSIF deleted %]
<div class="dialog message group-deleted">
[% IF deleted.title %]
Group [% deleted.title | $KohaSpan class = 'name' | $raw %] has been deleted.
Group [% deleted.title | html | $KohaSpan class = 'name' %] has been deleted.
[% ELSE %]
[% deleted.library | $KohaSpan class = 'name' | $raw %] has been removed from group.
[% deleted.library | html | $KohaSpan class = 'name' %] has been removed from group.
[% END %]
</div>
[% ELSIF error_duplicate_title %]
<div class="dialog alert error-duplicate-group-title">
A group with the title [% error_duplicate_title | $KohaSpan class = 'name' | $raw %] already exists.
A group with the title [% error_duplicate_title | html | $KohaSpan class = 'name' %] already exists.
</div>
[% END %]
@ -359,14 +359,14 @@
}
function delete_group( id, title ) {
$('#delete-group-modal-title').html(title);
$('#delete-group-modal-title').text( title );
$('#delete-group-modal-id').val( id );
$('#delete-group-modal').modal('show');
}
function remove_library( id, library, parent_title ) {
$('#remove-library-modal-library').html( library );
$('#remove-library-modal-group').html(parent_title);
$('#remove-library-modal-library').text( library );
$('#remove-library-modal-group').text( parent_title );
$('#remove-library-modal-id').val( id );
$('#remove-library-modal').modal('show');
}