This patch has been generated with the script provided on bug 21576.
It only affects variable used in the href attribute of a link *when*
href it the first attribute of the node (grep "a href")
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.
This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.
To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags
- Remove them from borrower_debarments.comments (there are allowed here)
update borrower_debarments set comment="html tags possible here";
- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)
Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
This patch adds a new menu for vendor-related pages in which
vendor related "views" can be linked to: baskets, basket groups,
contracts, invoices, uncertain prices.
The acquisitions toolbar is pared down to vendor-related actions:
New basket, contract, or vendor; edit vendor, delete vendor,
receive shipment.
Other small improvements have been made to other pages: corrections
to breadcrumbs and title tags, adding useful links betweeen pages.
Vendor menu and toolbar are added to booksellers.pl
when there is only one "search result" (i.e. a vendor id is passed).
- Menu appears when booksellerid variable is present
- Redundant heading removed
- Additional variables added to enable proper display of the toolbar
- Revision corrects broken links pointed out by QA.
- Revision adds check of existing baskets and subscriptions as a
condition on display of the vendor delete button.
TODO: Add coverage of Basket groups page.
To test, navigate Acquisitions pages and test as many links and buttons
as you can, confirming that nothing is broken on vendor pages, invoice
pages, contract pages, uncertain price pages, etc.
Signed-off-by: Nicole C. Engard <nengard@bywatersolutions.com>
All tests pass - I like this very much!
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
All tests and QA script pass.
Tests done:
1) New toolbar - vendor search
- no results = button to create new vendor shows
- 1 result = additional new options show
- more than one result = button to create new vendor shows
2) Vendor views
- acq toolbar consistent with 1 result in vendor search
- new tabs on the left
- checked all links have the needed parameters and work correctly
3) New toolbar - different pages
- Toolbar is formatted consistently
- Delete vendor shows only up when it should - no baskets or
subscriptions
- Links work correctly
Works nicely, great groundwork for further improvements.
TODO Add new toolbar to (new) invoices page.
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
