Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.
This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.
To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags
- Remove them from borrower_debarments.comments (there are allowed here)
update borrower_debarments set comment="html tags possible here";
- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)
Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
This patch doesn't fix how pagination links are generated for the label
item search results, but it does modify the template so that the
pagination links are styled like they are on catalog search results.
To test, apply the patch and go to Tools -> Labels.
- Open or create a label batch.
- Click "Add items" to trigger the pop-up search window.
- Perform a search which would return multiple results.
- Confirm that the style of the pagination bar matches the one on the
catalog search results page.
- Confirm that current-page number highlighting works correctly.
Signed-off-by: Maryse Simard <maryse.simard@inlibro.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
This patch modifies the staff client label creator templates so that
JavaScript is included in the footer instead of the header.
To test, apply the patch and test the JavaScript-driven features of
each modified template: All button controls, DataTables functionality,
form validation, etc.
This patch also modifies the templates to use the Bootstrap grid instead
of YUI, and removes obsolete "text/javascript" attributes from
<script> tags and "text/css" attributes from <style> tags in the
modified templates.
To test, apply the patch and test the following interactions:
- Creating and managing layouts
- Creating and managing batches
- Creating and managing templates
- Creating and managing printer profiles
- Creating quick spine labels
Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Having to write [% KOHA_VERSION %] for each url is bad because:
- It's easily forgettable when adding new <script> or <link>
- It prevents grep'ing for the full filename
- It violates the DRY principle
- If at some point we want to change the "force js and css reload"
mechanism, it will be tedious
This patch:
- adds a Template::Toolkit plugin that generates <script> and
<link> tags for JS and CSS files, and inserts automatically the Koha
version in the filename
- use the new plugin to remove all occurences of [% KOHA_VERSION %]
- remove the code that was adding KOHA_VERSION as a template variable
Test plan:
1. Apply patch
2. Go to several different pages in Koha (opac and intranet) while
checking your browser's dev tools (there should be no 404 for JS and
CSS files, and the Koha version should appear in filenames) and the
server logs (there should be no "File not found")
3. `git grep KOHA_VERSION` should return nothing
4. prove t/db_dependent/Koha/Template/Plugin/Asset.t
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch updates several label creator templates to remove the use of
"onclick" in favor of defining click events in JavaScript.
Also changed:
- Replaced the non-existant element <icon> with <i>
- Removed the use of <center> and 'align="center"';
- In the item search results template:
- The use of the checkboxes jQuery plugin has been replaced with
straight jQuery for simplicity's sake.
- Output of table headers has been modified so that translatable
strings are in the template instead of having English strings
passed from the script.
- Moved the 'Add checked' and 'Done' buttons into a floating toolbar.
To test, apply the patch and go to Tools -> Label creator.
- Choose New -> Label batch
- Click 'Add items'
- Perform a search for items.
- Confirm that 'select all' and 'clear all' links work.
- Confirm that clicking an individual 'Add' button works.
- Select multiple items and click the 'Add checked' button. Confirm
that the selected items were added to your batch.
- Click 'Add items' again to save the selected items to your batch.
- Test that the 'Delete' and 'Export' buttons next to any item work
correctly.
- Choose Manage -> Label batches
- Test that the 'Delete' button works correctly.
- Select one or more batches and test that the 'Export selected'
button works correctly.
Revision: Removed changes to pagination in the item search results
template since it didn't work.
Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Revert "DBRev to make notes of the XSS patches and the new important dependency."
This reverts commit e140603a59.
Revert "Bug 13618: Specific for branches.opac_info"
This reverts commit 06e4a50f00.
Revert "Bug 13618: (follow-up) Specific for other prefs"
This reverts commit d6475a111f.
Revert "Bug 13618: Fix for debarredcomment and patron messages"
This reverts commit dd98c9df92.
Revert "Bug 13618: Do not display html tags in patron's notices"
This reverts commit a065b243fe.
Revert "Bug 13618: Do not display and html tags in item fields content"
This reverts commit baeeaffbf8.
Revert "Bug 13618: Fix for system preference description"
This reverts commit a967a09261.
Revert "Bug 13618: Remove html filters for newly pushed code"
This reverts commit 0e98662b10.
Revert "Bug 13618: (follow-up) add missing lines for opac-shelves"
This reverts commit fc2fb605e5.
Revert "Bug 13618: (follow-up) Specific for ColumnsSettings"
This reverts commit bc308fdd9c.
Revert "Bug 13618: Fix for edit biblios and items"
This reverts commit 811c4e8402.
Revert "Bug 13618: followup to remove tabs"
This reverts commit ca8e8c397c.
Revert "Bug 13618: Fix last occurrences recently introduced to master"
This reverts commit bb417b256b.
Revert "Bug 13618: Fix for news"
This reverts commit ae5b98020a.
Revert "Bug 13618: Fix escape on sending baskets or shelves by email"
This reverts commit a7731ffe25.
Revert "Bug 13618: Specific for XSLTBloc"
This reverts commit 11fa38dc29.
Revert "Bug 13618: Specific for Salutation on editing a patron"
This reverts commit 36c07ad6d3.
Revert "Bug 13618: Specific for other prefs"
This reverts commit e6ea281a3b.
Revert "Bug 13618 - memberentrygen.tt errors Not a GLOB reference"
This reverts commit 7824874557.
Revert "Bug 13618: Specific for ColumnsSettings"
This reverts commit 1834da3da3.
Revert "Bug 13618: Specific for IntranetUser* and OPACUser* prefs"
This reverts commit 21ae62b253.
Revert "Bug 13618: Fix error 'Not a GLOB reference'"
This reverts commit 602bdbab4c.
Revert "Bug 13618: Specific for the ISBD view"
This reverts commit d254362435.
Revert "Bug 13618: Specific for pagination_bar"
This reverts commit 8837a8ae68.
Revert "Bug 13618: Specific places where we don't need to escape variables - intra"
This reverts commit 00eff140b3.
Revert "Bug 13618: Remove html filters at the intranet"
This reverts commit 7db851ff03.
Revert "Bug 13618: Specific places where we don't need to escape variables"
This reverts commit 49a3738b8d.
Revert "Bug 13618: Remove html filters at the OPAC"
This reverts commit cedaa0e23e.
Revert "Bug 13618: Use Template::Stash::AutoEscaping to use the html filter"
This reverts commit 01b38d3b13.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
This followup on top of remote branch
Only remove tabs and trailing spaces to make koha-qa pass
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
This patch changes the functionality of adding patrons to patroncard batches. Instead of using only the patron search, there is now a textarea which can either be manually populated with borrowernumbers, or can be populated using the patron-search
To test:
1 - Create a new patron batch
2 - Click the add items button, if there is no data in the borrowrnumber form you should get a popup
3 - Add items to batch using the popup, borrowernumbers should populate to the form
4 - Click add items again and items should be added to a new batch
5 - Create a new batch
6 - Manually enter invalid borrowernumbers to the form
7 - Click add items, batch should return empty
8 - Manually enter valid borrowernumber
9 - Click add items, batch should be updated
10 - Edit an existing batch and confirm add items works as above
11 - Create a new label batch
12 - Click add items with no data, popup item search should appear
13 - Adding items by checking boxes or using 'Add' button - they should populate the text box on the edit batch page
14 - When adding using form the 'Enter by itemnumber' button should be marked automatically
15 - Submit items and confirm they are added to batch
16 - Create a new batch, enter by barcode manually and check 'Enter by itemnumber"
17 - Click add items, no items should be added
18 - Repopulate form with barcodes, check 'Enter by barcode'
19 - Click add items, items should be added correctly
20 - Test various combinations of radio buttons and numbers and using form or not
Signed-off-by: Barton Chittenden <barton@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
This patch moves the checkboxes jQuery plugin to
intranet-tmpl/prog/lib/jquery/plugins so that it will not be duplicated
for each set of translated templates.
To test, apply the patch and confirm that select all/clear all controls
continue to work on the following pages:
- Acquisitions -> Late orders
- Acquisitions -> Add to order from an external source (search targets)
- Acquisitions -> Suggestions
- Administration -> Funds -> Planning (show/hide all columns)
* Some unused code has been removed
- Administration -> Library transfer limits
- Staff client cart
- Authorities -> New from Z39.50 (search targets)
- Cataloging -> New from Z39.50 (search targets)
- Circulation -> Check out to a patron (renew/check in selections)
- Circulation -> Offline circulation -> Pending operations
- Patrons -> Patron detail (renew/check in selections)
- Patrons -> Fines -> Pay fines
- Serials -> Subscription -> Serial collection
- Tools -> Label creator -> Batches -> Search results
- Tools -> Patron card creator -> Batches -> Search results
- Tools -> Tags moderation
- Tools -> Batch item deletion
- Tools -> Batch item modification
- Tools -> Inventory -> Submit a batch of barcodes
- Lists -> List contents view
Signed-off-by: David Cook <dcook@prosentient.com.au>
Works as described! I don't think I've ever checked so many boxes
before...
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
After talking to Owen we decided to use 2 classes for those modules. I decided on:
patroncard: tools, pcard
labels: tools, labels
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
- Fixing T:T scope issue
- Correcting footer include for pop-up windows.
- Markup correction for validity.
Signed-off-by: Nicole C. Engard <nengard@bywatersolutions.com>
Signed-off-by: Ian Walls <ian.walls@bywatersolutions.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
- Manage Batch had no branch set
- New Batch had no branch set
- Add link on item result list was broken, missing the batchid
To test:
Create a new batch and add items one by one. Look at 'Manage batches'.
Check that the branch in the top right corner is always correctly shown and set.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Ian Walls <ian.walls@bywatersolutions.com>
