Commit graph

7 commits

Author SHA1 Message Date
Jonathan Druart
dcd1f5d48c Bug 13618: Add html filters to all the variables
Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.

This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.

To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags

- Remove them from borrower_debarments.comments (there are allowed here)
update  borrower_debarments set comment="html tags possible here";

- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)

Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-08-17 15:55:05 +00:00
Katrin Fischer
1fa2bd185d Bug 7651: (QA follow-up) Fix warning about undefined active currency
If no active currency is defined we show a warning. This fixes
the link shown below to check the correct permission.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-07-18 17:45:22 +00:00
Marc Véron
0bfd512759 Bug 15049: (followup) Add warning about "No active currency"
Fix translatibiity issues and use include in admin/aqplan.tt as well.
See comment #24

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
2015-12-30 23:34:34 +00:00
Bernardo Gonzalez Kriegel
4587d898dc Bug 15049: (Signed off) Hide currency but preserv alert
This follow up hides currency, but the alert pops
if no currency is active.

To test:
1) Apply the patch
2) Unset any active currency
3) Alert must show on Acquisitons home
4) Set a currency active, no currency display on Acqui home
5) Check that currency IS displayed on /cgi-bin/koha/admin/aqbudgets.pl
or /cgi-bin/koha/admin/aqbudgetperiods.pl

Amended for better translation

Currency does / does not display as described in test plan.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: JM Broust <jean-manuel.broust@univ-lyon2.fr>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
2015-12-30 23:34:33 +00:00
Marc Véron
9d2e268739 Bug 15049: Add warning about "No active currency" to Acquisitions start page
If no active currency is defined, Acquisitions does not work properly and software
can occur while receiving.
This patch adds the warning message about missing active currency to Home > Acquisitions

To test:
- Apply patch
- Go to Home > Administration > Currencies & Exchange Rates > Currencies
- Make sure that no active currency is set
- Go to Home > Acquisitions
- Verify that a warning displays:
  - If user has at least permission for parameters_remaining_perissions,
    the warning should display a link to Currencies and exchange rates (currency.pl)
  - If the user has no permission to edit the Currencies and exchange rates,
    no link is displayed.
- Set an active currency
- Veryfy that the warning no longer displays

(Amended to remove superfluous line / mv)

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Work as described. No errors

Signed-off-by: JM Broust <jean-manuel.broust@univ-lyon2.fr>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
2015-12-30 23:34:33 +00:00
Chris Cormack
5884fb1000 Bug 5917 : Swapping templates over 2011-04-10 20:38:30 +12:00
4b69538f9b Fix for Bug 4913 - Budget pages should show currency name instead of symbol
This patch adds a new include file to handle the display of the active
currency name and a warning if no currency is active.

Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
2010-11-15 15:13:55 +13:00