Koha/koha-tmpl/intranet-tmpl/prog/en/includes/patron-toolbar.inc
Katrin Fischer 2d30845601 Bug 19125: Fix Stored XSS in members.pl
In preparation to test this patch:
- Add a patron list named <script>alert("patron list")</script>
- Add a library named <script>alert("library")</script>
- Add a patron category named <script>alert("patron category")</script>

To test:
- Access patron search page and do a search
- Verify that the alerts added above are executed
- Apply patch
- Verify that no alerts are displayed

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-09-29 12:20:45 -03:00

26 lines
1.4 KiB
HTML

[% USE Categories %]
[% USE Koha %]
[% SET categories = Categories.all %]
[% UNLESS ( no_add ) %]
<div id="toolbar" class="btn-toolbar">
<div class="btn-group">
<button class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown"><i class="fa fa-plus"></i> New patron <span class="caret"></span></button>
<ul class="dropdown-menu">
[% FOREACH category IN categories %]<li><a href="/cgi-bin/koha/members/memberentry.pl?op=add&amp;categorycode=[% category.categorycode %]">[% category.description |html %]</a></li>[% END %]
</ul>
</div>
[% IF Koha.Preference('PatronQuickAddFields') || Koha.Preference('BorrowerMandatoryField') %]
<div class="btn-group">
<button class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown"><i class="fa fa-plus"></i> Quick add new patron <span class="caret"></span></button>
<ul class="dropdown-menu">
[% FOREACH category IN categories %]<li><a href="/cgi-bin/koha/members/memberentry.pl?op=add&amp;categorycode=[% category.categorycode %]&amp;quickadd=true">[% category.description |html %]</a></li>[% END %]
</ul>
</div>
[% END %]
[% IF CAN_user_tools_manage_patron_lists %]
<a class="btn btn-default btn-sm" href="/cgi-bin/koha/patron_lists/lists.pl"><i class="fa fa-edit"></i> Patron lists</a>
[% END %]
</div>
[% END %]