Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.
This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.
To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags
- Remove them from borrower_debarments.comments (there are allowed here)
update borrower_debarments set comment="html tags possible here";
- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)
Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
If no active currency is defined we show a warning. This fixes
the link shown below to check the correct permission.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Fix translatibiity issues and use include in admin/aqplan.tt as well.
See comment #24
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
This follow up hides currency, but the alert pops
if no currency is active.
To test:
1) Apply the patch
2) Unset any active currency
3) Alert must show on Acquisitons home
4) Set a currency active, no currency display on Acqui home
5) Check that currency IS displayed on /cgi-bin/koha/admin/aqbudgets.pl
or /cgi-bin/koha/admin/aqbudgetperiods.pl
Amended for better translation
Currency does / does not display as described in test plan.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: JM Broust <jean-manuel.broust@univ-lyon2.fr>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
If no active currency is defined, Acquisitions does not work properly and software
can occur while receiving.
This patch adds the warning message about missing active currency to Home > Acquisitions
To test:
- Apply patch
- Go to Home > Administration > Currencies & Exchange Rates > Currencies
- Make sure that no active currency is set
- Go to Home > Acquisitions
- Verify that a warning displays:
- If user has at least permission for parameters_remaining_perissions,
the warning should display a link to Currencies and exchange rates (currency.pl)
- If the user has no permission to edit the Currencies and exchange rates,
no link is displayed.
- Set an active currency
- Veryfy that the warning no longer displays
(Amended to remove superfluous line / mv)
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Work as described. No errors
Signed-off-by: JM Broust <jean-manuel.broust@univ-lyon2.fr>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
This patch adds a new include file to handle the display of the active
currency name and a warning if no currency is active.
Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
