Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.
This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.
To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags
- Remove them from borrower_debarments.comments (there are allowed here)
update borrower_debarments set comment="html tags possible here";
- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)
Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
As we don't have a fix yet to link to the right translated manual,
this adds /en to the links from the help files to the manual to
make them work again.
Check with both patches applied, that the links work.
You will have to change 17.11 to 18.05.
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
The numbering in front of the chapter file names has been removed,
so the links need to be adapted accordingly.
Note:
Testing this in master currently won't work for 2 reasons:
- We are still using 17.11 as version variable, will be 18.05 later.
- We are missing the lanugage code before /html and this leads
to an outdated version of the 18.05 manual.
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
I generate a mapping files (old anchor > new anchor) from the doc files.
Here are the links that have been updated automatically
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This patch uses the version number of the Koha database to
dynamically generate links from help to the appropriate version
of the manual.
Test plan (for 3.15 branch):
- Open a help page
- Verify the manual link is correct (point to 3.14 manual)
- change the version in mysql:
update systempreferences set value="3.1600000" where variable="version";
- Verify the manual link now points to the future 3.16 manual.
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Work as described. No koha-qa errors
Tested on top of Bug 10671
On master (BD version 3.13.xxx) help links point to 3.12 manual
Changing version to 3.14/15 points to 3.14 manual
Changing version to 3.16 points to the future :)
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch updates the links to the manual in the
help files. It also updates the text a bit in a few.
To test:
* Visit admin pages
* Check the help files on each
* Make sure links and text appears
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
This patch updates the links to the manual and the text of the
admin help files.
To test:
Visit the help files on all admin pages and make sure the links and text
are right.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
This patch adds the help file for the transport cost matrix
and updates all others. Still needed is a help file for
'did you mean'.
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Copyedited Admin Help Files beginning with the letter "a."
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
This patch updates help files in the admin folder. It removes
two files that aren't used anymore and adds links to the manual
for all files that weren't edit in patches for bug 6942.
