Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.
This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.
To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags
- Remove them from borrower_debarments.comments (there are allowed here)
update borrower_debarments set comment="html tags possible here";
- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)
Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
This fixes some strings to be properly capitalized.
To test:
- Create a new routing list, check title and breadcrumbs
- View the routing list tab in the patron account in staff,
check title and breadcrumbs
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This patch modifies more staff client serials templates so
that JavaScript is included in the footer instead of the header.
To test, apply the patch and test the JavaScript-driven features of the
modified templates: All button controls, DataTables functionality, tabs,
etc.
- Serials -> Subscription detail -> Edit routing list
- Add recipients
- Save
- "Save and preview routing slip" should trigger preview
- In preview popup: Print and Close buttons should work correctly
Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch modifies several serials module templates to remove the use
of event attributes. Events will now be defined in JavaScript.
Also changed:
- In Serials -> Check expiration, custom form validation has been
removed in favor of validation with the plugin.
- In Serials -> Claims, the "Clear filter" button has been replaced with
a link. Error messages are now styled with the standard "alert" class.
- In Serials -> New subscription -> Search for record, the "choose" link
is now a Bootstrap button. Pagination links are now styled like other
similar links. The "Close" button is now styled as in other popup
windows. The "no results found" messages is styled as an informational
dialog.
- In Serials -> Subscription -> Edit routing list, the "add recipients"
and "delete all" controls are now links with Font Awesome icons.
To test, apply the patch and:
- Go to Serials -> Check expiration.
- Try to submit the form without filling in a date. The form
validation plugin should warn you that the date field is required.
- Submit the form using data which will return results.
- Click the "Renew" button for any result. The subscription renewal
popup should be triggered for the correct title.
- Go to Serials -> Claims.
- Select a vendor with missing issues.
- Confirm that the date filter works correctly, and that the "Clear
filter" link works.
- Select one or more result and click the "Send notification" button.
The notification should be sent.
- Go to Serials -> New subscription.
- Click the "Search for record" link to trigger the bibliographic
search popup.
- Perform a search. Confirm that the "Choose" button selects the
correct record and populates the fields in the parent window.
- Go to Serials -> Subscription -> Edit routing list.
- Confirm that the process of adding recipients to the list works
correctly.
- Confirm that changing the rank of any recipient works correctly.
- Save the routing list and click the "Save and preview routing slip"
button on the confirmation page. The slip preview should open.
- In the slip preview window, test that the print button works
correctly.
Signed-off-by: Aleisha <aleishaamohia@hotmail.com>
QA revision: Removed stray '// -->' and corrected clear filter function
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Revert "DBRev to make notes of the XSS patches and the new important dependency."
This reverts commit e140603a59.
Revert "Bug 13618: Specific for branches.opac_info"
This reverts commit 06e4a50f00.
Revert "Bug 13618: (follow-up) Specific for other prefs"
This reverts commit d6475a111f.
Revert "Bug 13618: Fix for debarredcomment and patron messages"
This reverts commit dd98c9df92.
Revert "Bug 13618: Do not display html tags in patron's notices"
This reverts commit a065b243fe.
Revert "Bug 13618: Do not display and html tags in item fields content"
This reverts commit baeeaffbf8.
Revert "Bug 13618: Fix for system preference description"
This reverts commit a967a09261.
Revert "Bug 13618: Remove html filters for newly pushed code"
This reverts commit 0e98662b10.
Revert "Bug 13618: (follow-up) add missing lines for opac-shelves"
This reverts commit fc2fb605e5.
Revert "Bug 13618: (follow-up) Specific for ColumnsSettings"
This reverts commit bc308fdd9c.
Revert "Bug 13618: Fix for edit biblios and items"
This reverts commit 811c4e8402.
Revert "Bug 13618: followup to remove tabs"
This reverts commit ca8e8c397c.
Revert "Bug 13618: Fix last occurrences recently introduced to master"
This reverts commit bb417b256b.
Revert "Bug 13618: Fix for news"
This reverts commit ae5b98020a.
Revert "Bug 13618: Fix escape on sending baskets or shelves by email"
This reverts commit a7731ffe25.
Revert "Bug 13618: Specific for XSLTBloc"
This reverts commit 11fa38dc29.
Revert "Bug 13618: Specific for Salutation on editing a patron"
This reverts commit 36c07ad6d3.
Revert "Bug 13618: Specific for other prefs"
This reverts commit e6ea281a3b.
Revert "Bug 13618 - memberentrygen.tt errors Not a GLOB reference"
This reverts commit 7824874557.
Revert "Bug 13618: Specific for ColumnsSettings"
This reverts commit 1834da3da3.
Revert "Bug 13618: Specific for IntranetUser* and OPACUser* prefs"
This reverts commit 21ae62b253.
Revert "Bug 13618: Fix error 'Not a GLOB reference'"
This reverts commit 602bdbab4c.
Revert "Bug 13618: Specific for the ISBD view"
This reverts commit d254362435.
Revert "Bug 13618: Specific for pagination_bar"
This reverts commit 8837a8ae68.
Revert "Bug 13618: Specific places where we don't need to escape variables - intra"
This reverts commit 00eff140b3.
Revert "Bug 13618: Remove html filters at the intranet"
This reverts commit 7db851ff03.
Revert "Bug 13618: Specific places where we don't need to escape variables"
This reverts commit 49a3738b8d.
Revert "Bug 13618: Remove html filters at the OPAC"
This reverts commit cedaa0e23e.
Revert "Bug 13618: Use Template::Stash::AutoEscaping to use the html filter"
This reverts commit 01b38d3b13.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
This second patch removes the previous way to search for serial recipients.
Test plan:
1/ Edit the routing list for a subscription (serials/routing.pl?subscriptionid=X)
2/ Add 1+ recipients
3/ Confirm there is no regression on the add/delete/search actions
QA note: This search does not use a clean way to interact with the
window opener. Indeed the opener is reloaded to display the new item.
This patch does not change this behavior, but note the trick in the
template (common/patron_search.tt) to wait for the opener in order not
to get a JS error.
This is also used by the next patch (patron card).
Tested together with other patches.
Signed-off-by: Marc Veron <veron@veron.ch>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
This patch replaces the XHTML DOCTYPE with an HTML5 one. The HTML5
validator seems to be significantly different than the XHTML one,
so I'm seeing lots of new errors. This patch includes corrections
for one: Deprecation of the "language" attribute of <script>
tags.
To test, view pages in the OPAC and staff client. They should
appear as normal. Numerous validation follow-ups will be required,
but I suggest these be handled incrementally.
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
test on some intranet pages and I found no regression. (chromium and
firefox).
The w3c page about the doctype: http://www.w3.org/TR/html5-diff/#doctype
Signed-off-by: Mason James <mtj@kohaaloha.com>
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
getroutinglist returns a count variable to indicate how many elements
are in the array. This is almost always a serious code smell. (We are
programming in a list manipulating language) The routine was executing
am unnecessary loop just to maintain that var.
Removed the variable from the routine and perldoc
refactored calls of the routine removed the c-style loops for
more idiomatic and maintainable for loops
renamed some opaquely named variables
removed a call to the routine where nothing was done with the data
moved some html out of the calling script and into the template
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Some old TMPL tags got left behind.
Signed-off-by: Nicole C. Engard <nengard@bywatersolutions.com>
Signed-off-by: Ian Walls <ian.walls@bywatersolutions.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
