Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.
This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.
To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags
- Remove them from borrower_debarments.comments (there are allowed here)
update borrower_debarments set comment="html tags possible here";
- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)
Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Having to write [% KOHA_VERSION %] for each url is bad because:
- It's easily forgettable when adding new <script> or <link>
- It prevents grep'ing for the full filename
- It violates the DRY principle
- If at some point we want to change the "force js and css reload"
mechanism, it will be tedious
This patch:
- adds a Template::Toolkit plugin that generates <script> and
<link> tags for JS and CSS files, and inserts automatically the Koha
version in the filename
- use the new plugin to remove all occurences of [% KOHA_VERSION %]
- remove the code that was adding KOHA_VERSION as a template variable
Test plan:
1. Apply patch
2. Go to several different pages in Koha (opac and intranet) while
checking your browser's dev tools (there should be no 404 for JS and
CSS files, and the Koha version should appear in filenames) and the
server logs (there should be no "File not found")
3. `git grep KOHA_VERSION` should return nothing
4. prove t/db_dependent/Koha/Template/Plugin/Asset.t
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This patch modifies the staff client "Additional tools" templates so
that JavaScript is included in the footer instead of the header:
- Calendar
- CSV profiles
- Log viewer
- News
- Task scheduler
- Edit quotes for QOTD feature
- Upload
Note that the log viewer template has been modified so that the
"interface" variable (passed to the template to provide the correct path
to staff client assets) isn't overwritten by an "interface" variable
required by the log viewer.
To test, apply the patch and test the JavaScript-driven features of
each modified template: All button controls, DataTables functionality,
form validation, etc.
Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This patch fixes some minor bugs and adds a small enhancement to the
quotes editor and quotes upload pages.
To test, apply the patch and go to Tools -> Quote editor
- In the table of quotes, clicking the "ID" table header should trigger
an alert, "Click on the quote's ide to select..."
- Go to "Import quotes" and select a file to upload.
- On the upload preview page you should see a new "Cancel import"
button. Clicking it should return you to the quotes upload page after
asking for confirmation.
- Test the upload cancel button:
- If you have fast reflexes or are uploading a file large enough, you
should be able to see a "Cancel upload" button during the upload
process.
- Clicking this button should cancel the upload and return you to the
quote upload page.
Tested on top of Bug 16589, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
The staff client CSS is not language-specific, so it can be moved out of
the en/ directory and thus not be duplicated for every translation.
In order to be able to have a generic path to the YUI CSS files, the YUI
directory is moved by this patch to the staff client's lib/ directory.
To test, apply the patch and visit various pages in the staff client.
Look in particular at pages which include more than the standard CSS.
For example:
- The staff client login page.
- The staff client home page.
- Patron -> Set permissions.
- The advanced cataloging editor.
- Acquisitions -> Vendor -> Basket groups.
- Tools -> News -> Edit news.
- Administration -> System preferences.
Revised: I intended for this to be built on top of Bug 15883. Now it is.
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
On top of 15883
Works as described, all pages on test plan
No Errors
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
The include file datatables-strings.inc is no longer necessary. Its
contents are now in datatables.inc. This patch corrects two references
in comments to datatables-strings.inc (replacing it with datatables.inc)
and removes the obsolete file.
To test, apply the patch and load any page with a DataTables-enabled
table configured to show pagination buttons, e.g. Saved Reports.
Pagination labels like "Next," "Previous," and "Showing X of X..."
should be correct.
Search the codebase to confirm that no references remain for
datatables-strings.inc.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch moves html markup out of explanatory text in Quote of the day editor and help
for better translatibility (Home > Tools > Quote Editor).
To test:
- Apply patch
- Go to Home > Tools > Quote Editor and related Help
- Verify that text changes make sense.
Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Rewording Ok for translation purposes
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Amended patch: Make consistent space after "Note:" (inside the br tag)
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
Without the patch the translated pages for quotes.tt may have the problematic line broken.
So the js is broken too. The line with bad usage of double quotes escaped :
var sEmptyTable = _("No quotes available. Please use the \"Add quote\" button to add a quote.");
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
diff on staff PO file
-msgid ""
-"No quotes available. Please use the \\\"Add quote\\\" button to add a quote."
+#, fuzzy
+msgid "No quotes available. Please use the 'Add quote' button to add a quote."
No koha-qa errors
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Something changed somewhere (maybe a new jQuery or datatables version)
and the javascript that redrew the table row after a new quote was saved
stopped working. This fixes the call to the datatables function so that
it matches the API.
Note that although the new quote didn't appear to be added, reloading
the page shows that it had been.
To test:
* Go and add a quote.
* Note that when you press enter after finishing the quote, the line
stops being an editor, and becomes just a display, like it should.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Currently translating Javascript strings with variables in them is hard,
because the strings are created from separate parts. For example:
_("Are you sure you want to delete the") + " " + count + " " +
_("attached items?")
This is translated in two different parts, and the translator cannot
affect the place where the count-variable is.
Now, if the javascript strings allowed placeholders, similar to how the
template strings do, the above could be written as:
_("Are you sure you want to delete the %s attached
items?").format(count)
This would make translation much easier.
Attached patch adds a Javascript string formatter, and changes all the
concatenated translatable JS strings used in intranet to use that.
To test:
1) cd misc/translator
2) perl translate update xx-YY
3) grep ^msgid po/xx-YY-i-staff-t-prog-v-3006000.po | sort | uniq >
xx-YY-pre
4) apply patch
5) perl translate update xx-YY
6) grep ^msgid po/xx-YY-i-staff-t-prog-v-3006000.po | sort | uniq >
xx-YY-post
7) compare the files: diff -Nurd xx-YY-pre xx-yy-post | less
should show the javascript strings that changed.
8) Test the UIs where the formatted js strings are used.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
I tested *most* of the changed files. There were some instances where it
wasn't clear to me how to trigger the warnings which were modified,
especially tags/review.tt, admin/manage-marc-import.tt, and holidays.tt.
Everything I was able to test worked correctly.
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Works nicely, no regressions found. Thx!
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
This patch moves the jeditable jQuery plugin to
intranet-tmpl/prog/lib/jquery/plugins so that it will not be duplicated
for each set of translated templates.
To test, apply the patch and confirm that editing quotes works correctly
in the Quote of the Day manager.
Works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
This patch makes improvements to the default DataTables CSS and corrects
a couple of errors in the original patch. CSS for the "full numbers"
type pagination, used by this and the quotes editor, has been cleaned up
and made more visually consistent with the brief pagination style.
Also changed:
- removed some hard-coded paths containing "http://staff.kohadev..."
- Added a column header to the column showing record match details. This
provides both information and a clearer target for clicking to resort
- Expanding the default table pager controls for this page and the
quotes editor (for consistency)
- Correction to quotes.css to fix pager display problem on wide screens
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 10649 introduced a new include file for adding DataTables-related
JavaScript assets. This patch adds use of this include file to the
quotes management page.
To test you should have a multiple quotes in your database. Apply the
patch and view the quotes manager page (tools/quotes.pl). Confirm that
table sorting works correctly.
Signed-off-by: merlissia <manuelimel@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
This patch converts the toolbar include file used by the quotes editor
to Bootstrap, replacing YUI button and menu code with Bootstrap markup.
To test, view any page in the quotes editor. Buttons and menus should
look correct and work correctly. Test save, delete, and upload buttons
on the summary page, and save and delete buttons on the upload page.
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Comment: All buttons work. Tested add, delete and upload.
You are using icon-remove and not icon-remove-circle,
which I prefer but is different of Bug 9627.
Question: "Import quotes" takes you to "Quotes uploader",
would not it be more consistent to use "Upload quotes" or
"Quotes importer"?
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Works nicely, no problems found.
I think the difference to 9627 is, that this really deletes
quotes, while the icon-remove-circle is used for closing subscriptions.
Closed subscriptions remain in the system, it's just a way to indicate
that there will be no new issues. There is a separate option to really
delete subscriptions.
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Tested all changes. Functionality is unchanged. Thanks for the taking
the extra effort to move alert strings into variables.
Signed-off-by: Mason James <mtj@kohaaloha.com>
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
I tested most scripts affected by this patch and visually verified
all changes. Functionality is unaffected.
Signed-off-by: Mason James <mtj@kohaaloha.com>
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
The strings for the table footer of the QOD feature are translated in /datatables-strings.inc, but they did not show up in staff client due to missing code in quotes.tt -> $(document).ready(function(), part "oLanguage"
Code added as appropriate.
See: http://datatables.net/usage/i18n
Additionally, quotes.tt had a stray </script> tag after [% INCLUDE 'datatables-strings.inc' %]
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
This patch implements more of oleonard's suggestions as well as other
improvments:
--Adds instructions for using the QOTD editor
--Moves inline css to quotes.css, etc.
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
This series will add a DataTable's based upload/editor with which
to upload csv files containing quotes to be used by the QOTD
feature.
The file should be formatted thusly:
"source","text-of-quote"
"source","text-of-quote"
...
Note: This work serves as a good example of potential improvements
in all other "editor" and file upload areas of Koha.
This patch is a squash of the following work:
--Adding code to parse CSV file contents and push it into a DataTable
--Adding in jEditable to enable table editing
--Adding ajax to post data back to the server to be saved
--Fixing edit and adding delete functionality
--Adding some missing css as well as server feedback on save
--Fixing a bug which limited the number of quotes which could be uploaded
--Also fixing a minor bug with fnCSVToArray and doing some style cleanup.
--Adding sanity checks to verify file type and size
--Implements YUI button widget/toolbar
--Improved handling of hiding uploader UI
--Adds row selectability
--Adds multi-delete capability
--Adds YUI button/toolbar widget
--Fixing capitalization in quote uploader
--Implements improvments suggested by jcamins and oleonard
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
This feature will add the option of displaying a select quote
for the day on the OPAC homepage. It will include the addition
of a QOTD editor in the tools section of the staff interface
which will allow the addition, editing, and deletion of quotes.
A single system preference will enable/disable the display of
the QOTD on the OPAC homepage. A new granular permission will
also be added to conrol user access to the QOTD editor tool.
Possible extentions to this would be code to allow alternate
quote selection algorithms to be added to vary how the currently
displayed quote is selected from the table of quotes.
This patch is a squash of the following work:
--Adding quotes table to kohastructure.sql and updatedatabase.pl
Note: This patch is intended for a MySQL based installation only.
That means that it includes backticks because that is what is required
at this point in history to install Koha correctly on a MySQL based
installation.
Feel free to port this over to the Pg stuff in the data/Pg directory.
--Adding system preference to control display of QOTD on OPAC main page
--Adding sample quote data
These quotes are taken from various US presidents. I'm not sure these
are applicable to the rest of the world, so I'm leaving it to translators
and others to add sample quote data for other languages.
--Adding edit_quotes user permissions
--Squash with other db related patches in this series
--Adding quotes editor pages to tools
--Adding QOTD editor link to tools homepage
--Integration of DataTables into QOTD Editor
--Impleminting jEditable into the quote editor
--Adding delete and add option to editor
--Fixing OPAC display so the QOTD div does not show if no quote is returned
--Also removing useless code from tools/quotes.pl
--Adding spans around QOTD foo in opac-main.tt
--Also fixing quote selection logic to accomodate the possibility of
a single quote in the db a litte better.
--Changing timestamp column header to a more user-friendly 'Last Displayed'
--Fixing bug in quote selection logic. This bug caused a situation where
when the table had only a single quote with an id greater than 1 in it,
no quote would be selected.
--Fixing up sorting in the quote editor table. --jcamins
--Adding span element to quote separator --jcamins
--Overriding the default empty table message supplied by datatables-strings.inc
--Adds missing page heading
--Adds beginning of click-for-help elements.
--Refactors delete functionality to allow selecting of quotes to delete,
enabling multi-delete.
--Refactors saving added quote functionality so that striking <Enter>
saves the new quote.
--Refactors canceling aded quote functionality so that striking <Esc>
cancels the new quote.
--Removing debug console.log statements
--Implementng the YUI button widget/toolbar used on other pages.
--Adds a 5px radius to all YUI buttons to bring them into
conformity with the general trend toward rounded corners
--Fixes capitalization in quote editor
--Implements improvements suggested by jcamins and oleonard
--Adds DataTables Plugin dataTables.fnReloadAjax.js
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
