Koha-community/Koha - Koha - Koha: The world's first free and open source library system

40315 Commits

34 Branches

590 Tags

2.3 GiB

Tree: bbf0d21284

Commit Graph

Author	SHA1	Message	Date
Katrin Fischer	bbf0d21284	Bug 26727: Fix <p/> appearing in the templates The self-closing p is not valid in HTML5: Error: Self-closing syntax (/>) used on a non-void HTML element. Ignoring the slash and treating as a start tag. To test: 1) - Activate Article requests - Search for a record to place an article request on in staff - Look up the patron - Verify the article request form looks ok 2) - Search for a list of patrons - Check 2 patrons and merge them using the button above the list - Verify the distance between the button and the table looks ok 3) - Create a new MARC modification template - Create a new action - Verify the distances between the first and second line of form elements looks ok 4) - Place a hold in staff - Click on the Suspend link in the holds table (not below) - Verify the modal looks ok Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>	4 years ago
Jonathan Druart	dcd1f5d48c	Bug 13618: Add html filters to all the variables Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>	9 years ago
Marcel de Rooy	331cbeb1df	Bug 10480: EXAMPLE plugin with associated template The EXAMPLE plugin helps you to create a new style framework plugin by providing a simple working example and additional documentation for developers. Test plan: [1] Connect the EXAMPLE plugin to one or more fields. [2] Try the following events: a- Focus: If the field is empty, it should put EXAMPLE: into it. b- MouseOver: If the field is empty and you move your mouse over it, it should have the same effect as Focus. c- Change: Edit the field in the editor and tab out of it, the color of the text should toggle (randomly) between red, green and blue. d- KeyPress: If you edit the field and you type @, it should give AT. e- Click: Click on the tag editor. Change the value in the popup. If you press OK, the field should be changed. [3] Would the documentation in the perl script help you to create a plugin? Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>	10 years ago

Author

SHA1

Message

Date

Katrin Fischer

bbf0d21284

Bug 26727: Fix <p/> appearing in the templates

The self-closing p is not valid in HTML5:

Error: Self-closing syntax (/>) used on a non-void HTML element.
Ignoring the slash and treating as a start tag.

To test:

1)
- Activate Article requests
- Search for a record to place an article request on in staff
- Look up the patron
- Verify the article request form looks ok
2)
- Search for a list of patrons
- Check 2 patrons and merge them using the button above the list
- Verify the distance between the button and the table looks ok
3)
- Create a new MARC modification template
- Create a new action
- Verify the distances between the first and second line of form
  elements looks ok
4)
- Place a hold in staff
- Click on the Suspend link in the holds table (not below)
- Verify the modal looks ok

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

4 years ago

Jonathan Druart

dcd1f5d48c

Bug 13618: Add html filters to all the variables

Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.

This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.

To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags

- Remove them from borrower_debarments.comments (there are allowed here)
update  borrower_debarments set comment="html tags possible here";

- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)

Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

9 years ago

Marcel de Rooy

331cbeb1df

Bug 10480: EXAMPLE plugin with associated template

The EXAMPLE plugin helps you to create a new style framework plugin by
providing a simple working example and additional documentation for
developers.

Test plan:
[1] Connect the EXAMPLE plugin to one or more fields.
[2] Try the following events:
    a- Focus: If the field is empty, it should put EXAMPLE: into it.
    b- MouseOver: If the field is empty and you move your mouse over it,
       it should have the same effect as Focus.
    c- Change: Edit the field in the editor and tab out of it, the color
       of the text should toggle (randomly) between red, green and blue.
    d- KeyPress: If you edit the field and you type @, it should give AT.
    e- Click: Click on the tag editor. Change the value in the popup.
       If you press OK, the field should be changed.
[3] Would the documentation in the perl script help you to create a plugin?

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>

10 years ago

3 Commits (bbf0d21284924d6b7529017fc78178b98242aaee)