Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.
This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.
To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags
- Remove them from borrower_debarments.comments (there are allowed here)
update borrower_debarments set comment="html tags possible here";
- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)
Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
This patch updates several acquisitions module templates to use the
Bootstrap grid.
- acqui/z3950_search.tt - Acquisitions -> Vendor -> View basket -> Add
to basket -> From an external source. The Z39.50 search form should
look correct.
- Search for a title. The search results page should look correct.
- acqui/addorder.tt - Acquisitions -> Vendor -> View basket -> Add to
basket. Add an order to the basket which costs more than is available
in the fund you select. The error/confirmation screen should look
correct.
- acqui\modordernotes.tt - Acquisitions -> Vendor -> View basket -> Add
internal or vendor note. The note add form should look correct.
- acqui/cancelorder.tt - Acquisitions -> Vendor -> View basket -> Cancel
order (from an open basket which has existing orders). The
confirmation screen should look correct.
- acqui\basketheader.tt - Acquisitions -> Vendor -> New basket. The new
basket edit form should look correct.
Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Revert "DBRev to make notes of the XSS patches and the new important dependency."
This reverts commit e140603a59.
Revert "Bug 13618: Specific for branches.opac_info"
This reverts commit 06e4a50f00.
Revert "Bug 13618: (follow-up) Specific for other prefs"
This reverts commit d6475a111f.
Revert "Bug 13618: Fix for debarredcomment and patron messages"
This reverts commit dd98c9df92.
Revert "Bug 13618: Do not display html tags in patron's notices"
This reverts commit a065b243fe.
Revert "Bug 13618: Do not display and html tags in item fields content"
This reverts commit baeeaffbf8.
Revert "Bug 13618: Fix for system preference description"
This reverts commit a967a09261.
Revert "Bug 13618: Remove html filters for newly pushed code"
This reverts commit 0e98662b10.
Revert "Bug 13618: (follow-up) add missing lines for opac-shelves"
This reverts commit fc2fb605e5.
Revert "Bug 13618: (follow-up) Specific for ColumnsSettings"
This reverts commit bc308fdd9c.
Revert "Bug 13618: Fix for edit biblios and items"
This reverts commit 811c4e8402.
Revert "Bug 13618: followup to remove tabs"
This reverts commit ca8e8c397c.
Revert "Bug 13618: Fix last occurrences recently introduced to master"
This reverts commit bb417b256b.
Revert "Bug 13618: Fix for news"
This reverts commit ae5b98020a.
Revert "Bug 13618: Fix escape on sending baskets or shelves by email"
This reverts commit a7731ffe25.
Revert "Bug 13618: Specific for XSLTBloc"
This reverts commit 11fa38dc29.
Revert "Bug 13618: Specific for Salutation on editing a patron"
This reverts commit 36c07ad6d3.
Revert "Bug 13618: Specific for other prefs"
This reverts commit e6ea281a3b.
Revert "Bug 13618 - memberentrygen.tt errors Not a GLOB reference"
This reverts commit 7824874557.
Revert "Bug 13618: Specific for ColumnsSettings"
This reverts commit 1834da3da3.
Revert "Bug 13618: Specific for IntranetUser* and OPACUser* prefs"
This reverts commit 21ae62b253.
Revert "Bug 13618: Fix error 'Not a GLOB reference'"
This reverts commit 602bdbab4c.
Revert "Bug 13618: Specific for the ISBD view"
This reverts commit d254362435.
Revert "Bug 13618: Specific for pagination_bar"
This reverts commit 8837a8ae68.
Revert "Bug 13618: Specific places where we don't need to escape variables - intra"
This reverts commit 00eff140b3.
Revert "Bug 13618: Remove html filters at the intranet"
This reverts commit 7db851ff03.
Revert "Bug 13618: Specific places where we don't need to escape variables"
This reverts commit 49a3738b8d.
Revert "Bug 13618: Remove html filters at the OPAC"
This reverts commit cedaa0e23e.
Revert "Bug 13618: Use Template::Stash::AutoEscaping to use the html filter"
This reverts commit 01b38d3b13.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
Followed test plan from patch 1/2, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
As asked by QAer,
this followup fixes wording in modordernotes.tt for vendor note
(Change order vendor note vendor note => Change order vendor note)
It also uses [%- and -%] to make code more readable
Test plan :
try to edit a vendor note, check the wording is correct in breadcrumbs
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Works as described, should be nicely translatable now.
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
This bug changes some lines in modordernotes.tt to make them more easily
translatable, especially in german (remark by K. Fisher on bug 9416).
No change should be visible
It also suppresses the ability to edit order "vendor note" in reception,
as the note for vendor is not made to be changed after the document is
received.
Test plan :
- in a basket, try to edit the notes (internal and vendor) of order.
Check the display is correct
- go in reception module (parcel.pl page) : in the list of all orders
to receive, you should have a link to change "internal note", but no
more link to change "vendor note"
- try to receive a specific order which have a "vendor note". On the
right panel of the page, you must have an editable textarea for
internal note, and a non-editable (colored in grey) textarea for
vendor note
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
This followup answer QA remarks :
- neworderempty.pl updated so that the 2 new variables are passed
to the template
- modordernotes.tt fixed to make the translation easier
- in CSV headers, to make clear that no change are made for the moment,
rename "note" to "internal note"
Additionnaly, "Publisher code" was wrong in the csv headers. I changed
it to "Publisher" (the field in database is publishercode, but the
content is a real publisher name, not a code)
I did not change "Note:" in modordernotes.tt, because it is just under
a h1 tag which specifies the type of note the librarian is editing.
Test plan :
- edit an existing order, and try to change/add/delete the vendor note,
and the internal note. Check the changes are properly saved
- export a basket and a basketgroup in CSV. Check the columns headers
are "Publisher" and "Vendor note"
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Fixed some tabs. Passes QA script and tests.
Tested:
- add notes when creating an order
- edit notes modifying an order line
- edit notes using the links on the basket summary
- check basket CSV export
- close basket
- check basket group CSV export
- edit notes on order receive page using the links
- edit notes on receive
Note: Translatability of templates could be improved by a follow-up.
It's better not to divide up sentences with if/else structures.
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Currently, there is a single note field in each order. It would be
useful to have 2 notes fields:
- one for the staff (ex: "catalog this book as soon as possible")
- one for the vendor (ex: "urgent", "only the 2d volume"...), which
could later be printed in basketgroup pdf for example
This patch adds a new note made for vendor in each order. The existing
note is renamed "internal note".
The behavior of the 2 notes are the same
Changes in database structure:
- new column aqorders.order_vendornote
- column aqorders.notes renamed aqorders.order_internalnote
To test :
[1] Make a complete acquisiton process (creating the order > looking at
the basket > looking the order > receiving); and try to use the 2
notes (internal note / vendor note)
[2] Check the changes made on one page (eg detail of the order) are
saved and visible on an other page (eg receipt page)
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Testing notes on last patch.
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
When a user creates a new vendor, a new borrower or a new basket
(maybe on others page too, to be listed), a creation form is displayed,
but the focus is still on the search textbox on page top.
It would be probably better to switch the focus to the first field of
the creation form.
This patch adds the focus, for acquisitions module, on first input for
pages with a data creation or modification or pages with only one form
(like Z3950 search).
Test plan :
Go to pages and look where is the focus :
- acqui/basketgroup.pl : focus on "Basket group name:"
- acqui/basketheader.pl : focus on "Basket name:"
- acqui/invoices.tt : focus on "Invoice no:"
- acqui/modordernotes.pl : focus on "Notes:"
- acqui/neworderempty.pl : focus on "Title:"
- acqui/supplier.pl : focus on "Name:"
- acqui/z3950_search.pl : focus on "Title:"
Signed-off-by: Melia Meggs <melia@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
The focus choice is relevant and works as described.
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
When you are on parcel.pl or basket.pl you can now add or edit a note
for each order.
To test:
Create orders with and without note.
Edit/Add the note on basket.pl page
Close the basket.
Check you can add/edit the order note on parcel.pl page
+ From Owen:
Correcting markup issues with modordernotes.pl:
- Adding "rows" and "cols" attributes to <textarea> (required)
- Converting cancel button to link to stay consistent with
other pages
- Changing page layout to fixed & centered (not sidebar needed)
- Expanding information in breadcrumbs to match information
on basket.pl
Changing markup around note add and edit links: Moving output
of order note to the end of the table cell, putting it in its
own paragraph, and adding a "Note:" label
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
