Commit graph

9 commits

Author SHA1 Message Date
f510627842 Bug 14544: Make the OPAC side independent of Page.pm
Bug 14544: Fix redirect on editing a list

If you edit a list from the list view, after saving the form, you are
not redirected to the list view (but on the edit form).

Bug 14544: Cosmetic: › should be a class divider

Signed-off-by: Alex Arnaud <alex.arnaud@biblibre.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-11-05 09:58:01 -03:00
6f75aa11ff Bug 14544: Make the intranet side independent of Page.pm
Signed-off-by: Alex Arnaud <alex.arnaud@biblibre.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-11-05 09:58:01 -03:00
75c70d42a5 Bug 14517: List shelves list is broken for translated interfaces
The translation script adds quotes ("") around translated string (Edit
for instance).
Which breaks the json structure.

Example:
"dt_action": "<a style=\"cursor:pointer\"><form action='shelves.pl'
method='get'><input class="editshelf" value="Editar" type="submit"
/></form></a>"

Test plan:
1/ On the staff interface create a private list
2/ Go to More > Lists ('Your lists' tab)
3/ Translate the templates to any language like:
  $ cd misc/translator/
  $ perl translate install es-ES
4/ Enable the translated templates on the sysprefs
5/ Switch to the translated language
6/ Go to the lists page (Mas > Listas in es-ES)
The list should be displayed correctly.

Note: There is a limitation. If a translated string contains a simple
quote ('), it will also break the json.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-08-18 13:18:21 -03:00
3ec6c88ae1 Bug 14529: Allow user to delete lists
Bug 13417 allows a librarian to delete any lists if he has the
permission (delete_public_lists).

There is a mismatch in the perm check.
A user can delete a list with the ability to edit (manage) it.

Test plan:
1/ Create a list A with user A
2/ Create a list B with user B
3/ A should be able to manage and delete the list A.
He cans delete B only if he is superlibrarian or has the
delete_public_lists permission.

Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-08-18 13:18:21 -03:00
Chris Cormack
703a928b9d Bug 14416: Stored XSS vulnerability
The affected page in the OPAC client is:
http://testbox:9001/cgi-bin/koha/opac-shelves.pl
the vulnerable parameter: addshelf

The affected page in the STAFF client is:
http://testbox:9002/cgi-bin/koha/virtualshelves/shelves.pl

To test:
1/ Create a shelf in the opac that contains some malicious js
 eg Bad stuff <script>alert('oh noes');</script> as the name
2/ Go to /cgi-bin/koha/virtualshelves/shelves.pl in the staff client
  Note the js is executed
3/ View
http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1
  Notice the html is not escaped
4/ Apply patch
5/ View
http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1
  Notice the html is now escaped
6/ View /cgi-bin/koha/virtualshelves/shelves.pl - no more exploit

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-22 10:59:59 -03:00
cf5219b434 Bug 13421: (QA followup) Change creation_time to created_on
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-05-04 12:31:59 -03:00
Jonathan Druart
66bc6a38d6 Bug 13421: Add the creation time for virtual shelves
Test plan:
1/ Execute the updatedb entry
2/ Create a list
3/ Go on the shelve list and confirm that the creation and last
modification time are now displayed.
4/ Confirm that you are able to sort the list by creation/modification
time.

Applied on top of 13419 (rebased updatedatabase.pl)
Works as expected.
Signed-off-by: Marc Veron <veron@veron.ch>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-05-04 12:31:51 -03:00
Jonathan Druart
fead2a72b0 Bug 13419: Add filters on the list table
Tested together with patch #1, works as expected
Signed-off-by: Marc Veron <veron@veron.ch>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-04-22 14:59:05 -03:00
Jonathan Druart
87b6d46fec Bug 13419: Add server-side processing for lists
This patch adds DataTables using a server-side processing to display
lists (virtual shelves).

Test plan:
1/ Go on virtualshelves/shelves.p
2/ Play with the table functions (sort, filter, pagination, etc.)
3/ Go with the Public lists tab and verify the table is correctly
filtered.

Tested together with patch #2, works as expected.
Signed-off-by: Marc Veron <veron@veron.ch>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-04-22 14:59:02 -03:00