Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.
This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.
To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags
- Remove them from borrower_debarments.comments (there are allowed here)
update borrower_debarments set comment="html tags possible here";
- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)
Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
In order to simplify and make uniform the code, the controller scripts send
a Koha::Patron object to the templates instead of all attributes of a patron.
That will make the code much more easier to maintain and will be less
error-prone.
The variable "patron" sent to the templates is supposed to represent the
patron the librarian is editing the detail.
In the members module and some scripts of the circulation module, the
patron's detail are sent one by one to the template. That leads to
frustration from developpers (making sure everything is passed from all
scripts) and to regression (we got tone of bugs in the last year because
of this way to do).
With this patch set it will be easy access patron's detail, passing only
1 variable from the controllers.
Test plan:
Play with the patron and circulation module and make sur the detail of
the patron you are editing/seeing info are correctly displayed.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
There is a duplicate ID in HTML code, because of this:
<input type="text" id="B_address" name="B_streetnumber" size="5"
value="" />
<input type="text" id="B_address" name="B_address" size="40" value="" />
Test plan:
1) Edit a patron and look into its HTML code
2) Find input: name="B_streetnumber"
3) Its ID is B_address - a duplicate within the code in fact
4) Apply the patch
5) Repeat steps 1 and 2
6) The ID is unique now: B_streetnumber
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Table 'borrowers' contain columns B_streetnumber and B_streettype.
This patch makes them editable for alternate address.
To test:
- Apply patch
- Edit a patron's details
- Verify that in edit mode for Alternate address, the fields 'street type' and 'street number' appear
and follow the settings in sysprefs AddressFormat, BorrowerMandatoryField, BorrowerUnwantedField
- Verify that the values are saved correctly.
Note: A second patch will follow to manage the display of street number and street type
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
To test:
1) Login to OPAC --> You personal details.
2) Ensure it says 'ZIP/Postal Code' under Main Address, Alternate Address and Alternate Contact
3) Login to Staff interface --> Go to a member's page (ie koha/members/memberentry.pl) --> Details.
4) Ensure it says 'ZIP/Postal Code' under Alternate address and Alternative contact
5) Click Edit
6) Ensure it says 'ZIP/Postal Code' under Main Address, Alternate Address and Alternate Contact
Signed-off-by: Barry Cannon <bc@interleaf.ie>
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
NOTE: Tested together with second patch.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch extracts the address blocks in memberentrygen.tt to include files.
To test: The overall functionality should remain the same with this patch.
In further steps, more country- or region-dependent includes could be added, along with functionality to select them using a system preference.
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
