This patch modifies templates where a pop-up window is used to display
patron search results. A link has been added to the patron name which
triggers a modal window displaying more details about that patron. With
each page in the test plan, check that clicking linked names in search
results triggers a modal with the correct data.
- Acquisitions -> Vendor -> View basket -> Add user
- Acquisitions -> Vendor -> Add to basket -> From a new (empty) record
-> Add user
- Acquisitions -> Funds -> Edit fund -> Select owner
- Tools -> Patron card creator -> Manage -> Card batches -> Edit -> Add
patrons
- Serials -> Subscription -> Edit routing list -> Add recipients
Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.
This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.
To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags
- Remove them from borrower_debarments.comments (there are allowed here)
update borrower_debarments set comment="html tags possible here";
- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)
Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch removes the use of "onclick" from several patron card creator
templates. Events are defined instead in JavaScript.
Also changed:
- Patron search pop-up window is now slightly larger because I found it
never quite large enough to prevent horizontal scrolling.
- Replaced "Borrower" with "Patron" in a couple of places.
- "Add" link in patron search pop-up is now styled as a Bootstrap
button.
- Removed Bootstrap styles from some submit buttons.
- Some Font Awesome icons were made using the invalid element
<icon></icon> instead of <i></i>. These are corrected.
- Fixed some other HTML validation errors.
To test, apply the patch and go to Tools -> Patron card creator.
- Choose New -> Card batch.
- Click "Add patrons" and perform a search for patrons in the pop-up
window.
- Click the "Add" button. The corresponding borrowernumber should be
added to the textarea in the parent window, and a message should
appear at the top of the pop-up window confirming that the patron
has been added. (Note: This patch fixes a version of Bug 13041 which
prevented the "add" button from working on patrons whose name
include an apostrophe).
- In the parent page, in the list of patrons you added to the batch,
confirm that clicking the "Delete" link triggers a confirmation
dialog. Test both confirming and canceling.
- Confirm that clicking the "Export" button next to an individual
patron triggers a modal window.
- In the export window, confirm that the "Cancel" link works to
close the modal.
- Click the "Export" button again and then the "Export" button in
the modal.
- Test that the "Done" button works to close the modal.
- Choose Manage -> Card batches.
- Test the "Delete" and "Export" buttons as described above.
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
All works, no errors.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
If patron infos contain invalid JSON chars (\t for instance), the
results won't appear.
The solution is to escape these info.
Test plan:
Edit patron infos in DB (update borrowers set surname="foobar\t" where
borrowernumber=42)
Search for foobar (you should have more than 1 result)
Without this patch, DT retrieves a bad formatted JSON and the results
won't appear.
With this patch, the table result appears
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
Revert "DBRev to make notes of the XSS patches and the new important dependency."
This reverts commit e140603a59.
Revert "Bug 13618: Specific for branches.opac_info"
This reverts commit 06e4a50f00.
Revert "Bug 13618: (follow-up) Specific for other prefs"
This reverts commit d6475a111f.
Revert "Bug 13618: Fix for debarredcomment and patron messages"
This reverts commit dd98c9df92.
Revert "Bug 13618: Do not display html tags in patron's notices"
This reverts commit a065b243fe.
Revert "Bug 13618: Do not display and html tags in item fields content"
This reverts commit baeeaffbf8.
Revert "Bug 13618: Fix for system preference description"
This reverts commit a967a09261.
Revert "Bug 13618: Remove html filters for newly pushed code"
This reverts commit 0e98662b10.
Revert "Bug 13618: (follow-up) add missing lines for opac-shelves"
This reverts commit fc2fb605e5.
Revert "Bug 13618: (follow-up) Specific for ColumnsSettings"
This reverts commit bc308fdd9c.
Revert "Bug 13618: Fix for edit biblios and items"
This reverts commit 811c4e8402.
Revert "Bug 13618: followup to remove tabs"
This reverts commit ca8e8c397c.
Revert "Bug 13618: Fix last occurrences recently introduced to master"
This reverts commit bb417b256b.
Revert "Bug 13618: Fix for news"
This reverts commit ae5b98020a.
Revert "Bug 13618: Fix escape on sending baskets or shelves by email"
This reverts commit a7731ffe25.
Revert "Bug 13618: Specific for XSLTBloc"
This reverts commit 11fa38dc29.
Revert "Bug 13618: Specific for Salutation on editing a patron"
This reverts commit 36c07ad6d3.
Revert "Bug 13618: Specific for other prefs"
This reverts commit e6ea281a3b.
Revert "Bug 13618 - memberentrygen.tt errors Not a GLOB reference"
This reverts commit 7824874557.
Revert "Bug 13618: Specific for ColumnsSettings"
This reverts commit 1834da3da3.
Revert "Bug 13618: Specific for IntranetUser* and OPACUser* prefs"
This reverts commit 21ae62b253.
Revert "Bug 13618: Fix error 'Not a GLOB reference'"
This reverts commit 602bdbab4c.
Revert "Bug 13618: Specific for the ISBD view"
This reverts commit d254362435.
Revert "Bug 13618: Specific for pagination_bar"
This reverts commit 8837a8ae68.
Revert "Bug 13618: Specific places where we don't need to escape variables - intra"
This reverts commit 00eff140b3.
Revert "Bug 13618: Remove html filters at the intranet"
This reverts commit 7db851ff03.
Revert "Bug 13618: Specific places where we don't need to escape variables"
This reverts commit 49a3738b8d.
Revert "Bug 13618: Remove html filters at the OPAC"
This reverts commit cedaa0e23e.
Revert "Bug 13618: Use Template::Stash::AutoEscaping to use the html filter"
This reverts commit 01b38d3b13.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
With the href attribute, the cusor will be displayed as a pointer.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
To Test -
1. Go onto Tools and then click on Patron Card Creator.
2. Click on New and then Card Batch.
3. Add a borrowernumber then add patron.
4. Search for a patron.
5. Using the tab key try to navigate onto the Add link.
6. Notice it skips Add.
7. Apply the patch and then repeat steps 1-5, notice the add link can now be accessed through using the keyboard.
Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Works as described.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
This third patch removes the previous way to search for patron cards users.
Test plan:
1/ Add items to a patron card batch (patroncards/edit-batch.pl?op=edit&element_id=X)
2/ Add 1+ patrons to the batch
3/ Confirm there is no regression
Tested together with other patches.
Signed-off-by: Marc Veron <veron@veron.ch>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
