Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.
This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.
To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags
- Remove them from borrower_debarments.comments (there are allowed here)
update borrower_debarments set comment="html tags possible here";
- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)
Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
As we don't have a fix yet to link to the right translated manual,
this adds /en to the links from the help files to the manual to
make them work again.
Check with both patches applied, that the links work.
You will have to change 17.11 to 18.05.
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
The numbering in front of the chapter file names has been removed,
so the links need to be adapted accordingly.
Note:
Testing this in master currently won't work for 2 reasons:
- We are still using 17.11 as version variable, will be 18.05 later.
- We are missing the lanugage code before /html and this leads
to an outdated version of the 18.05 manual.
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Without the anchor it is not possible to retrieve the html page, so
these occurrences have been updated manually (and yes it was painful)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
I generate a mapping files (old anchor > new anchor) from the doc files.
Here are the links that have been updated automatically
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This patch corrects several typos: Some reported in Bug 11503, others
found during a systematic spell check of the help files.
To test, examine the changes and confirm that the spelling changes are
correct.
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
This patch uses the version number of the Koha database to
dynamically generate links from help to the appropriate version
of the manual.
Test plan (for 3.15 branch):
- Open a help page
- Verify the manual link is correct (point to 3.14 manual)
- change the version in mysql:
update systempreferences set value="3.1600000" where variable="version";
- Verify the manual link now points to the future 3.16 manual.
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Work as described. No koha-qa errors
Tested on top of Bug 10671
On master (BD version 3.13.xxx) help links point to 3.12 manual
Changing version to 3.14/15 points to 3.14 manual
Changing version to 3.16 points to the future :)
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
To test visit the plugin pages and confirm that the links
to the manual are right.
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Links correct
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
This adds a help file to the new plugins module.
To test:
Activate the plugin module and check the text and links in the help file
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
