Commit graph

17 commits

Author SHA1 Message Date
Jonathan Druart
dcd1f5d48c Bug 13618: Add html filters to all the variables
Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.

This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.

To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags

- Remove them from borrower_debarments.comments (there are allowed here)
update  borrower_debarments set comment="html tags possible here";

- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)

Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-08-17 15:55:05 +00:00
1d54746cb2 Bug 6647: Label item search should use standard pagination routine
This patch doesn't fix how pagination links are generated for the label
item search results, but it does modify the template so that the
pagination links are styled like they are on catalog search results.

To test, apply the patch and go to Tools -> Labels.

 - Open or create a label batch.
 - Click "Add items" to trigger the pop-up search window.
 - Perform a search which would return multiple results.
 - Confirm that the style of the pagination bar matches the one on the
   catalog search results page.
 - Confirm that current-page number highlighting works correctly.

Signed-off-by: Maryse Simard <maryse.simard@inlibro.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-07-13 10:34:29 +00:00
3c887b4e07 Bug 19709: Move template JavaScript to the footer: Labels
This patch modifies the staff client label creator templates so that
JavaScript is included in the footer instead of the header.

To test, apply the patch and test the JavaScript-driven features of
each modified template: All button controls, DataTables functionality,
form validation, etc.

This patch also modifies the templates to use the Bootstrap grid instead
of YUI, and removes obsolete "text/javascript" attributes from
<script> tags and "text/css" attributes from <style> tags in the
modified templates.

To test, apply the patch and test the following interactions:

- Creating and managing layouts
- Creating and managing batches
- Creating and managing templates
- Creating and managing printer profiles
- Creating quick spine labels

Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-07-06 13:33:49 +00:00
Julian Maurice
ed7543287b Bug 20538: Remove the need of writing [% KOHA_VERSION %] everywhere
Having to write [% KOHA_VERSION %] for each url is bad because:
- It's easily forgettable when adding new <script> or <link>
- It prevents grep'ing for the full filename
- It violates the DRY principle
- If at some point we want to change the "force js and css reload"
  mechanism, it will be tedious

This patch:
- adds a Template::Toolkit plugin that generates <script> and
  <link> tags for JS and CSS files, and inserts automatically the Koha
  version in the filename
- use the new plugin to remove all occurences of [% KOHA_VERSION %]
- remove the code that was adding KOHA_VERSION as a template variable

Test plan:
1. Apply patch
2. Go to several different pages in Koha (opac and intranet) while
   checking your browser's dev tools (there should be no 404 for JS and
   CSS files, and the Koha version should appear in filenames) and the
   server logs (there should be no "File not found")
3. `git grep KOHA_VERSION` should return nothing
4. prove t/db_dependent/Koha/Template/Plugin/Asset.t

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-04-13 11:49:44 -03:00
0ad922011c Bug 12904: Force browser to load new javascript files after upgrade
This patch has been automatically generated using:
  perl kv.pl **/*.tt **/*.inc

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
2018-02-08 14:53:24 -03:00
804677265e Bug 16239: Update templates
Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2017-01-13 14:41:22 +00:00
b118074fe4 Bug 16576 [Revised] Remove the use of "onclick" from label templates
This patch updates several label creator templates to remove the use of
"onclick" in favor of defining click events in JavaScript.

Also changed:
 - Replaced the non-existant element <icon> with <i>
 - Removed the use of <center> and 'align="center"';
 - In the item search results template:
   - The use of the checkboxes jQuery plugin has been replaced with
     straight jQuery for simplicity's sake.
   - Output of table headers has been modified so that translatable
     strings are in the template instead of having English strings
     passed from the script.
   - Moved the 'Add checked' and 'Done' buttons into a floating toolbar.

To test, apply the patch and go to Tools -> Label creator.

- Choose New -> Label batch
  - Click 'Add items'
    - Perform a search for items.
    - Confirm that 'select all' and 'clear all' links work.
    - Confirm that clicking an individual 'Add' button works.
    - Select multiple items and click the 'Add checked' button. Confirm
      that the selected items were added to your batch.
  - Click 'Add items' again to save the selected items to your batch.
  - Test that the 'Delete' and 'Export' buttons next to any item work
    correctly.
- Choose Manage -> Label batches
  - Test that the 'Delete' button works correctly.
  - Select one or more batches and test that the 'Export selected'
    button works correctly.

Revision: Removed changes to pagination in the item search results
template since it didn't work.

Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-09-09 12:11:21 +00:00
a8942c2884 Revert bug 13618 - "Prevent XSS in the Staff Client and the OPAC" due to performance issues
Revert "DBRev to make notes of the XSS patches and the new important dependency."

This reverts commit e140603a59.

Revert "Bug 13618: Specific for branches.opac_info"

This reverts commit 06e4a50f00.

Revert "Bug 13618: (follow-up) Specific for other prefs"

This reverts commit d6475a111f.

Revert "Bug 13618: Fix for debarredcomment and patron messages"

This reverts commit dd98c9df92.

Revert "Bug 13618: Do not display html tags in patron's notices"

This reverts commit a065b243fe.

Revert "Bug 13618: Do not display &nbsp; and html tags in item fields content"

This reverts commit baeeaffbf8.

Revert "Bug 13618: Fix for system preference description"

This reverts commit a967a09261.

Revert "Bug 13618: Remove html filters for newly pushed code"

This reverts commit 0e98662b10.

Revert "Bug 13618: (follow-up) add missing lines for opac-shelves"

This reverts commit fc2fb605e5.

Revert "Bug 13618: (follow-up) Specific for ColumnsSettings"

This reverts commit bc308fdd9c.

Revert "Bug 13618: Fix for edit biblios and items"

This reverts commit 811c4e8402.

Revert "Bug 13618: followup to remove tabs"

This reverts commit ca8e8c397c.

Revert "Bug 13618: Fix last occurrences recently introduced to master"

This reverts commit bb417b256b.

Revert "Bug 13618: Fix for news"

This reverts commit ae5b98020a.

Revert "Bug 13618: Fix escape on sending baskets or shelves by email"

This reverts commit a7731ffe25.

Revert "Bug 13618: Specific for XSLTBloc"

This reverts commit 11fa38dc29.

Revert "Bug 13618: Specific for Salutation on editing a patron"

This reverts commit 36c07ad6d3.

Revert "Bug 13618: Specific for other prefs"

This reverts commit e6ea281a3b.

Revert "Bug 13618 - memberentrygen.tt errors Not a GLOB reference"

This reverts commit 7824874557.

Revert "Bug 13618: Specific for ColumnsSettings"

This reverts commit 1834da3da3.

Revert "Bug 13618: Specific for IntranetUser* and OPACUser* prefs"

This reverts commit 21ae62b253.

Revert "Bug 13618: Fix error 'Not a GLOB reference'"

This reverts commit 602bdbab4c.

Revert "Bug 13618: Specific for the ISBD view"

This reverts commit d254362435.

Revert "Bug 13618: Specific for pagination_bar"

This reverts commit 8837a8ae68.

Revert "Bug 13618: Specific places where we don't need to escape variables - intra"

This reverts commit 00eff140b3.

Revert "Bug 13618: Remove html filters at the intranet"

This reverts commit 7db851ff03.

Revert "Bug 13618: Specific places where we don't need to escape variables"

This reverts commit 49a3738b8d.

Revert "Bug 13618: Remove html filters at the OPAC"

This reverts commit cedaa0e23e.

Revert "Bug 13618: Use Template::Stash::AutoEscaping to use the html filter"

This reverts commit 01b38d3b13.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-02-11 19:39:53 +00:00
Bernardo Gonzalez Kriegel
ca8e8c397c Bug 13618: followup to remove tabs
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
This followup on top of remote branch
Only remove tabs and trailing spaces to make koha-qa pass

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-01-29 17:54:15 +00:00
Jonathan Druart
7db851ff03 Bug 13618: Remove html filters at the intranet
Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala@gmail.com>

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-01-29 17:54:12 +00:00
Nick Clemens
a8a9c7b7fd Bug 14739: Add several patrons to a new batch will create a new batch per patron added
This patch changes the functionality of adding patrons to patroncard batches.  Instead of using only the patron search, there is now a textarea which can either be manually populated with borrowernumbers, or can be populated using the patron-search

To test:
1 - Create a new patron batch
2 - Click the add items button, if there is no data in the borrowrnumber form you should get a popup
3 - Add items to batch using the popup, borrowernumbers should populate to the form
4 - Click add items again and items should be added to a new batch
5 - Create a new batch
6 - Manually enter invalid borrowernumbers to the form
7 - Click add items, batch should return empty
8 - Manually enter valid borrowernumber
9 - Click add items, batch should be updated
10 - Edit an existing batch and confirm add items works as above
11 - Create a new label batch
12 - Click add items with no data, popup item search should appear
13 - Adding items by checking boxes or using 'Add' button - they should populate the text box on the edit batch page
14 - When adding using form the 'Enter by itemnumber' button should be marked automatically
15 - Submit items and confirm they are added to batch
16 - Create a new batch, enter by barcode manually and check 'Enter by itemnumber"
17 - Click add items, no items should be added
18 - Repopulate form with barcodes, check 'Enter by barcode'
19 - Click add items, items should be added correctly
20 - Test various combinations of radio buttons and numbers and using form or not

Signed-off-by: Barton Chittenden <barton@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-10-06 10:25:22 -03:00
1e69481103 Bug 12107 - Move checkboxes jQuery plugin outside of language-specific directory
This patch moves the checkboxes jQuery plugin to
intranet-tmpl/prog/lib/jquery/plugins so that it will not be duplicated
for each set of translated templates.

To test, apply the patch and confirm that select all/clear all controls
continue to work on the following pages:

- Acquisitions -> Late orders
- Acquisitions -> Add to order from an external source (search targets)
- Acquisitions -> Suggestions
- Administration -> Funds -> Planning (show/hide all columns)
  * Some unused code has been removed
- Administration -> Library transfer limits
- Staff client cart
- Authorities -> New from Z39.50 (search targets)
- Cataloging -> New from Z39.50 (search targets)
- Circulation -> Check out to a patron (renew/check in selections)
- Circulation -> Offline circulation -> Pending operations
- Patrons -> Patron detail (renew/check in selections)
- Patrons -> Fines -> Pay fines
- Serials -> Subscription -> Serial collection
- Tools -> Label creator -> Batches -> Search results
- Tools -> Patron card creator -> Batches -> Search results
- Tools -> Tags moderation
- Tools -> Batch item deletion
- Tools -> Batch item modification
- Tools -> Inventory -> Submit a batch of barcodes
- Lists -> List contents view

Signed-off-by: David Cook <dcook@prosentient.com.au>

Works as described! I don't think I've ever checked so many boxes
before...

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2014-04-25 15:12:20 +00:00
643c80663d Bug 2780 - Capitalize strings consistently (Labels templates)
Correcting capitalization in Labels templates

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
2012-04-10 10:03:53 +02:00
Katrin Fischer
f8626343e2 Bug 7760 - Add ids and classes to every staff page to help with customization (patroncard, labels)
After talking to Owen we decided to use 2 classes for those modules. I decided on:

patroncard: tools, pcard
labels: tools, labels
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
2012-03-22 18:12:33 +01:00
dd208da05a Fix for Bug 6635, Can't page through results in label batch
- Fixing T:T scope issue
- Correcting footer include for pop-up windows.
- Markup correction for validity.

Signed-off-by: Nicole C. Engard <nengard@bywatersolutions.com>
Signed-off-by: Ian Walls <ian.walls@bywatersolutions.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
2011-08-02 09:00:11 +12:00
Katrin Fischer
f515052d6e Bug 6343: TT issues in label creator
- Manage Batch had no branch set
- New Batch had no branch set
- Add link on item result list was broken, missing the batchid

To test:
Create a new batch and add items one by one. Look at 'Manage batches'.
Check that the branch in the top right corner is always correctly shown and set.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Ian Walls <ian.walls@bywatersolutions.com>
2011-05-26 09:16:41 +12:00
Chris Cormack
5884fb1000 Bug 5917 : Swapping templates over 2011-04-10 20:38:30 +12:00
Renamed from koha-tt/intranet-tmpl/prog/en/modules/labels/result.tt (Browse further)