Jonathan Druart
6c1b39b4cb
If you click on a link that opens a new tab/window to another site, that tab has access to the original window through JavaScript. The browsing context is related, even if the domains are totally different. The tab retains access to the original window's object via window.opener, even if you navigate to another page or domain, in the new or original window. Access to the Window object means the new window can use Window.location to open a different URL in the original window, perfect for phishing attacks. Depending on the site's Same-Origin Policy settings, the new window may have access to other parts of the original window's DOM as well. Any 'A HREF' that contains a target of of '_blank' or '_new' or a fixed name is vulnerable. Previous security best practice often suggested creating a random fixed name for an unpredictable namespace - that won't help with this problem! Targets of '_self' and '_parent' are safe. We do not use _new (at first glance) but several _blank. Some are used to refer internal url, we do not need to update or remove them. Others are used to satisfy OPACURLOpenInNewWindow, in these case, we should add the rel="noreferrer" attribute to the a tags. In other cases, we can simply remove them and let the users discover that a mouse has more than one button (we are in 2016, they can do it!) Signed-off-by: Chris <chrisc@catalyst.net.nz> Signed-off-by: Jesse Weaver <jweaver@bywatersolutions.com> Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
429 lines
26 KiB
Text
429 lines
26 KiB
Text
[% USE Koha %]
|
|
[% USE KohaDates %]
|
|
[% SET TagsInputEnabled = ( ( Koha.Preference( 'opacuserlogin' ) == 1 ) && TagsEnabled && TagsInputOnList ) %]
|
|
|
|
[% INCLUDE 'doc-head-open.inc' %]
|
|
<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog › Your cart</title>
|
|
[% INCLUDE 'doc-head-close.inc' %]
|
|
[% BLOCK cssinclude %]<style type="text/css">.item-status { display: inline; }</style>[% END %]
|
|
</head>
|
|
[% INCLUDE 'bodytag.inc' bodyid='basket' %]
|
|
<div class="main">
|
|
<div class="container-fluid">
|
|
<div class="row-fluid">
|
|
<div class="span12">
|
|
<div id="userbasket">
|
|
<h2>Your cart</h2>
|
|
|
|
[% UNLESS ( print_basket ) %]
|
|
<div id="toolbar" class="toolbar">
|
|
[% IF ( verbose ) %]
|
|
<a href="opac-basket.pl" class="brief" onclick="showLess(); return false;">Brief display</a>
|
|
[% ELSE %]
|
|
<a href="opac-basket.pl" class="detail" onclick="showMore(); return false;">More details</a>
|
|
[% END %]
|
|
[% IF Koha.Preference( 'opacuserlogin' ) == 1 %]
|
|
<a class="send" href="opac-basket.pl" onclick="sendBasket(); return false;">Send</a>
|
|
[% END %]
|
|
<a class="download" href="opac-basket.pl" onclick="downloadBasket(); return false;">Download</a>
|
|
<a class="print-large" href="opac-basket.pl" onclick="printBasket(); return false;">Print</a>
|
|
<a class="empty" href="opac-basket.pl" onclick="delBasket(); return false;">Empty and close</a>
|
|
<a class="hide close" href="opac-basket.pl">Hide window</a>
|
|
</div>
|
|
|
|
<div id="selections-toolbar" class="toolbar">
|
|
<a id="CheckAll" href="#">Select all</a>
|
|
<a id="CheckNone" href="#">Clear all</a>
|
|
<span class="sep">|</span>
|
|
<span class="links" id="tag_hides">
|
|
<span id="selections">Select titles to: </span>
|
|
<a href="#" class="deleteshelf disabled" onclick="delSelRecords(); return false;">Remove</a>
|
|
[% IF ( Koha.Preference( 'opacuserlogin' ) == 1 ) %]
|
|
[% IF ( ( Koha.Preference( 'virtualshelves' ) == 1 ) && loggedinusername ) %]
|
|
<a href="#" class="newshelf disabled" onclick="addSelToShelf(); return false;">Add to a list</a>
|
|
[% END %]
|
|
[% IF ( Koha.Preference( 'RequestOnOpac' ) == 1 ) %]
|
|
<a href="#" class="hold disabled" onclick="holdSel(); return false;">Place hold</a>
|
|
[% END %]
|
|
[% IF ( TagsInputEnabled && loggedinusername ) %]
|
|
<a href="#" id="tagsel_tag" class="disabled" onclick="tagSelected(); return false;">Tag</a>
|
|
[% END %]
|
|
[% END # / IF opacuserlogin %]
|
|
</span>
|
|
[% IF ( TagsInputEnabled && loggedinusername ) %]
|
|
<span id="tagsel_form" style="display:none">
|
|
<label for="tagsel_new">New tag:</label>
|
|
<input name="tagsel_new" id="tagsel_new" maxlength="100" />
|
|
<input id="tagsel_button" name="tagsel_button" class="input tagsel_button" title="Add" type="submit" value="Add" onclick="tagAdded(); return false;" />
|
|
<a href="#" id="tagsel_cancel" onclick="tagCanceled(); return false;">Cancel</a>
|
|
</span>
|
|
[% END %]
|
|
</div>
|
|
[% END # / UNLESS print_basket %]
|
|
|
|
[% IF ( verbose ) %]
|
|
<form action="opac-basket.pl" method="get" name="bookbag_form" id="bookbag_form" class="checkboxed">
|
|
[% FOREACH BIBLIO_RESULT IN BIBLIO_RESULTS %]
|
|
<h3>
|
|
[% IF ( print_basket ) %]
|
|
[% BIBLIO_RESULT.title |html %]
|
|
[% IF ( BIBLIO_RESULT.subtitle ) %] [% FOREACH subtitl IN BIBLIO_RESULT.subtitle %] [% subtitl.subfield |html %] [% END %][% END %]
|
|
[% IF ( BIBLIO_RESULT.author ) %] [% BIBLIO_RESULT.author |html %][% END %]
|
|
[% ELSE %]
|
|
<input type="checkbox" class="cb" value="[% BIBLIO_RESULT.biblionumber %]" name="bib[% BIBLIO_RESULT.biblionumber %]" id="bib[% BIBLIO_RESULT.biblionumber %]" onclick="selRecord(value,checked)" />
|
|
[% BIBLIO_RESULT.title |html %]
|
|
[% IF ( BIBLIO_RESULT.subtitle ) %] [% FOREACH subtitl IN BIBLIO_RESULT.subtitle %] [% subtitl.subfield |html %] [% END %][% END %]
|
|
[% IF ( BIBLIO_RESULT.author ) %] [% BIBLIO_RESULT.author |html %][% END %]
|
|
[% END # / IF print_basket %]
|
|
</h3>
|
|
<!-- COinS / Openurl -->
|
|
<span class="Z3988" title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.au=[% BIBLIO_RESULT.author %]&rft.btitle=[% BIBLIO_RESULT.title |url %]&rft.date=[% BIBLIO_RESULT.publicationyear %]&rft.tpages=[% BIBLIO_RESULT.item('size') %]&rft.isbn=[% BIBLIO_RESULT.isbn |url %]&rft.aucorp=&rft.place=[% BIBLIO_RESULT.place %]&rft.pub=[% BIBLIO_RESULT.publisher |url %]&rft.edition=[% BIBLIO_RESULT.edition %]&rft.series=[% BIBLIO_RESULT.series %]&rft.genre="></span>
|
|
|
|
<table class="table">
|
|
[% IF ( BIBLIO_RESULT.isbn ) %]
|
|
<tr>
|
|
<th scope="row">ISBN</th>
|
|
<td>[% BIBLIO_RESULT.isbn %]</td>
|
|
</tr>
|
|
[% END %]
|
|
|
|
[% IF ( BIBLIO_RESULT.HASAUTHORS ) %]
|
|
<tr>
|
|
<th scope="row">Author(s)</th>
|
|
<td>
|
|
[% IF ( BIBLIO_RESULT.author ) %]
|
|
<p>[% BIBLIO_RESULT.author %]</p>
|
|
[% END %]
|
|
[% IF ( BIBLIO_RESULT.MARCAUTHORS ) %]
|
|
[% FOREACH MARCAUTHOR IN BIBLIO_RESULT.MARCAUTHORS %]
|
|
<p> [% FOREACH MARCAUTHOR_SUBFIELDS_LOO IN MARCAUTHOR.MARCAUTHOR_SUBFIELDS_LOOP %]
|
|
[% MARCAUTHOR_SUBFIELDS_LOO.separator %]
|
|
[% MARCAUTHOR_SUBFIELDS_LOO.value %]
|
|
[% END %]
|
|
</p>
|
|
[% END %]
|
|
[% END %]
|
|
</td>
|
|
</tr>
|
|
[% END %]
|
|
|
|
[% IF ( BIBLIO_RESULT.publishercode ) %]
|
|
<tr>
|
|
<th scope="row">Publisher</th>
|
|
<td>[% BIBLIO_RESULT.place %] [% BIBLIO_RESULT.publishercode %] [% BIBLIO_RESULT.publicationyear %]
|
|
</td>
|
|
</tr>
|
|
[% END %]
|
|
|
|
[% IF ( BIBLIO_RESULT.pages ) %]
|
|
<tr>
|
|
<th scope="row">Details</th>
|
|
<td>[% BIBLIO_RESULT.pages %] [% BIBLIO_RESULT.illus %] [% BIBLIO_RESULT.item('size') %]</td>
|
|
</tr>
|
|
[% END %]
|
|
|
|
[% IF ( BIBLIO_RESULT.seriestitle ) %]
|
|
<tr>
|
|
<th scope="row">Collection</th>
|
|
<td> [% BIBLIO_RESULT.seriestitle %]</td>
|
|
</tr>
|
|
[% END %]
|
|
|
|
[% IF ( BIBLIO_RESULT.MARCSUBJCTS ) %]
|
|
<tr>
|
|
<th scope="row">Subject(s)</th>
|
|
<td>[% FOREACH MARCSUBJCT IN BIBLIO_RESULT.MARCSUBJCTS %]
|
|
<p> [% FOREACH MARCSUBJECT_SUBFIELDS_LOO IN MARCSUBJCT.MARCSUBJECT_SUBFIELDS_LOOP %]
|
|
[% MARCSUBJECT_SUBFIELDS_LOO.separator %][% MARCSUBJECT_SUBFIELDS_LOO.value %][% END %]
|
|
</p>
|
|
[% END %]</td>
|
|
</tr>
|
|
[% END %]
|
|
|
|
[% IF ( BIBLIO_RESULT.copyrightdate ) %]
|
|
<tr><th scope="row">Copyright</th>
|
|
<td> [% BIBLIO_RESULT.copyrightdate %]</td>
|
|
</tr>
|
|
[% END %]
|
|
|
|
[% IF ( BIBLIO_RESULT.MARCNOTES ) %]
|
|
<tr>
|
|
<th scope="row">Notes</th>
|
|
<td>
|
|
[% FOREACH MARCNOTE IN BIBLIO_RESULT.MARCNOTES %]
|
|
<p>
|
|
[% IF MARCNOTE.marcnote.match('^https?://\S+$') %]
|
|
- <a href="[% MARCNOTE.marcnote %]">[% MARCNOTE.marcnote %]</a>
|
|
[% ELSE %]
|
|
- [% MARCNOTE.marcnote %]
|
|
[% END %]
|
|
</p>
|
|
[% END %]
|
|
</td>
|
|
</tr>
|
|
[% END %]
|
|
|
|
[% IF ( BIBLIO_RESULT.unititle ) %]
|
|
<tr>
|
|
<th scope="row">Unified title</th>
|
|
<td> [% BIBLIO_RESULT.unititle %]</td>
|
|
</tr>
|
|
[% END %]
|
|
|
|
[% IF ( BIBLIO_RESULT.serial ) %]
|
|
<tr>
|
|
<th scope="row">Serial</th>
|
|
<td>[% BIBLIO_RESULT.serial %]</td>
|
|
</tr>
|
|
[% END %]
|
|
|
|
[% IF ( BIBLIO_RESULT.dewey ) %]
|
|
<tr>
|
|
<th scope="row">Dewey</th>
|
|
<td>[% BIBLIO_RESULT.dewey %]</td>
|
|
</tr>
|
|
[% END %]
|
|
|
|
[% IF ( BIBLIO_RESULT.classification ) %]
|
|
<tr>
|
|
<th scope="row">Classification</th>
|
|
<td> [% BIBLIO_RESULT.classification %]</td>
|
|
</tr>
|
|
[% END %]
|
|
|
|
[% IF ( BIBLIO_RESULT.lccn ) %]
|
|
<tr>
|
|
<th scope="row">LCCN</th>
|
|
<td> [% BIBLIO_RESULT.lccn %]</td>
|
|
</tr>
|
|
[% END %]
|
|
|
|
[% IF BIBLIO_RESULT.MARCURLS.size %]
|
|
<tr>
|
|
<th scope="row">URL(s)</th>
|
|
<td>
|
|
[% FOREACH MARCurl IN BIBLIO_RESULT.MARCURLS %]
|
|
[% IF MARCurl.part %]<p>[% MARCurl.part %]</p>[% END %]
|
|
|
|
[% IF OPACURLOpenInNewWindow %]
|
|
<a href="[% MARCurl.MARCURL %]" title="[% MARCurl.MARCURL %]" target="_blank" rel="noreferrer">[% MARCurl.linktext %]</a>
|
|
[% ELSE %]
|
|
<a href="[% MARCurl.MARCURL %]" title="[% MARCurl.MARCURL %]">[% MARCurl.linktext %]</a>
|
|
[% END %]
|
|
|
|
[% IF MARCurl.notes %][% FOREACH note IN MARCurl.notes %]<p>[% note.note %]</p>[% END %][% END %]
|
|
[% END %]
|
|
</td>
|
|
</tr>
|
|
[% END %]
|
|
|
|
<tr>
|
|
<th scope="row">Location(s) (Status)</th>
|
|
<td>
|
|
[% IF ( BIBLIO_RESULT.ITEM_RESULTS ) %]
|
|
<ul>
|
|
[% FOREACH ITEM_RESULT IN BIBLIO_RESULT.ITEM_RESULTS %]
|
|
<li>
|
|
<strong>[% ITEM_RESULT.branchname %]</strong>[% IF ( ITEM_RESULT.location_opac ) %], [% ITEM_RESULT.location_opac %][% END %]
|
|
[% IF ( ITEM_RESULT.itemcallnumber ) %]
|
|
([% ITEM_RESULT.itemcallnumber %])
|
|
[% END %]
|
|
([% INCLUDE 'item-status.inc' item = ITEM_RESULT %])
|
|
</li>
|
|
[% END %]
|
|
</ul>
|
|
[% ELSE %]
|
|
This record has no items.
|
|
[% END %]
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
[% END # / FOREACH BIBLIO_RESULT %]
|
|
</form>
|
|
|
|
[% ELSE %]
|
|
|
|
<form action="/cgi-bin/koha/opac-basket.pl" method="get" name="bookbag_form" id="bookbag_form" class="checkboxed">
|
|
<table id="itemst" class="table table-bordered table-striped">
|
|
<thead>
|
|
<tr>
|
|
[% UNLESS ( print_basket ) %]<th> </th>[% END %]
|
|
<th>Title</th>
|
|
<th>Author</th>
|
|
<th>Year</th>
|
|
<th>Location (Status)</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
[% FOREACH BIBLIO_RESULT IN BIBLIO_RESULTS %]
|
|
<tr>
|
|
[% UNLESS ( print_basket ) %]
|
|
<td>
|
|
<input type="checkbox" class="cb" value="[% BIBLIO_RESULT.biblionumber %]" name="bib[% BIBLIO_RESULT.biblionumber %]" id="bib[% BIBLIO_RESULT.biblionumber %]" onclick="selRecord(value,checked);" />
|
|
</td>
|
|
[% END %]
|
|
<td>
|
|
<a href="#" onclick="openBiblio('[% BIBLIO_RESULT.dest %]',[% BIBLIO_RESULT.biblionumber %])">[% BIBLIO_RESULT.title |html %][% IF ( BIBLIO_RESULT.subtitle ) %] [% FOREACH subtitl IN BIBLIO_RESULT.subtitle %][% subtitl.subfield |html %][% END %][% END %]</a>
|
|
<!-- COinS / Openurl -->
|
|
<span class="Z3988" title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.au=[% BIBLIO_RESULT.author %]&rft.btitle=[% BIBLIO_RESULT.title |url %]&rft.date=[% BIBLIO_RESULT.publicationyear %]&rft.tpages=[% BIBLIO_RESULT.item('size') %]&rft.isbn=[% BIBLIO_RESULT.isbn |url %]&rft.aucorp=&rft.place=[% BIBLIO_RESULT.place %]&rft.pub=[% BIBLIO_RESULT.publisher |url %]&rft.edition=[% BIBLIO_RESULT.edition %]&rft.series=[% BIBLIO_RESULT.series %]&rft.genre="></span>
|
|
[% IF ( TagsInputEnabled && loggedinusername ) %]
|
|
<span id="newtag[% BIBLIO_RESULT.biblionumber %]_status" class="tagstatus results_summary" style="display:none">Tag status here.</span>
|
|
[% END %]
|
|
</td>
|
|
<td>[% BIBLIO_RESULT.author %]</td>
|
|
<td>
|
|
[% IF ( BIBLIO_RESULT.publicationyear ) %]
|
|
[% BIBLIO_RESULT.publicationyear %]
|
|
[% ELSE %]
|
|
[% BIBLIO_RESULT.copyrightdate %]
|
|
[% END %]
|
|
</td>
|
|
<td>[% IF ( BIBLIO_RESULT.ITEM_RESULTS ) %]<ul>[% FOREACH ITEM_RESULT IN BIBLIO_RESULT.ITEM_RESULTS %]
|
|
<li>
|
|
[% ITEM_RESULT.branchname %][% IF ( ITEM_RESULT.location_opac ) %], [% ITEM_RESULT.location_opac %][% END %]
|
|
[% IF ( ITEM_RESULT.itemcallnumber ) %]
|
|
([% ITEM_RESULT.itemcallnumber %])
|
|
[% END %]
|
|
([% INCLUDE 'item-status.inc' item = ITEM_RESULT %])
|
|
</li>
|
|
[% END %]</ul>[% ELSE %]This record has no items.[% END %]
|
|
</td>
|
|
</tr>
|
|
[% END # / FOREACH BIBLIO_RESULT %]
|
|
</tbody>
|
|
</table>
|
|
</form>
|
|
[% END # / verbose %]
|
|
|
|
[% UNLESS ( print_basket ) %]
|
|
<form name="myform" action="opac-basket.pl" method="get">
|
|
<input type="hidden" name="records" id="records" />
|
|
</form>
|
|
[% END %]
|
|
|
|
</div> <!-- / #userbasket -->
|
|
</div> <!-- / .span10 -->
|
|
</div> <!-- / .row-fluid -->
|
|
</div> <!-- / .container-fluid -->
|
|
</div> <!-- / .main -->
|
|
|
|
[% INCLUDE 'opac-bottom.inc' %]
|
|
|
|
[% BLOCK jsinclude %]
|
|
[% IF ( print_basket ) %]
|
|
<script type="text/javascript">
|
|
//<![CDATA[
|
|
$(document).ready(function(){
|
|
print();
|
|
location.href="/cgi-bin/koha/opac-basket.pl?bib_list=[% bib_list %][% IF ( verbose ) %]&verbose=1[% END %]";
|
|
});
|
|
//]]>
|
|
</script>
|
|
[% ELSE %]
|
|
<script type="text/javascript" src="[% interface %]/[% theme %]/lib/jquery/plugins/jquery.checkboxes.min.js"></script>
|
|
[% INCLUDE 'datatables.inc' %]
|
|
<script type="text/javascript">
|
|
//<![CDATA[
|
|
|
|
[% IF ( TagsInputEnabled && loggedinusername ) %]
|
|
function tagSelected() {
|
|
var bibs = document.getElementById('records').value;
|
|
if (bibs) {
|
|
$("#tagsel_tag").hide();
|
|
$("#tag_hides").hide();
|
|
$("#tagsel_form").show();
|
|
} else {
|
|
alert(MSG_NO_RECORD_SELECTED);
|
|
}
|
|
}
|
|
|
|
function tagCanceled() {
|
|
$("#tagsel_form").hide();
|
|
$("#tagsel_tag").show();
|
|
$("#tag_hides").show();
|
|
$("#tagsel_new").val("");
|
|
$(".tagstatus").empty().hide();
|
|
}
|
|
|
|
function tagAdded() {
|
|
var checkedBoxes = $("input:checkbox:checked");
|
|
if (!$(checkedBoxes).size()) {
|
|
alert(MSG_NO_RECORD_SELECTED);
|
|
return false;
|
|
}
|
|
|
|
var tag = $("#tagsel_new").val();
|
|
if (!tag || (tag == "")) {
|
|
alert(MSG_NO_TAG_SPECIFIED);
|
|
return false;
|
|
}
|
|
|
|
var bibs = [];
|
|
for (var i = 0; i < $(checkedBoxes).size(); i++) {
|
|
var box = $(checkedBoxes).get(i);
|
|
bibs[i] = $(box).val();
|
|
}
|
|
|
|
KOHA.Tags.add_multitags_button(bibs, tag);
|
|
return false;
|
|
}
|
|
[% END # / TagsInputEnabled && loggedinusername %]
|
|
|
|
$(document).ready(function(){
|
|
$("#CheckAll").click(function(){
|
|
var checked = [];
|
|
$(".checkboxed").checkCheckboxes("*", true).each(
|
|
function() {
|
|
selRecord(this.value,true);
|
|
}
|
|
);
|
|
enableCheckboxActions();
|
|
return false;
|
|
});
|
|
|
|
$("#CheckNone").click(function(){
|
|
var checked = [];
|
|
$(".checkboxed").unCheckCheckboxes("*",true).each(
|
|
function() {
|
|
selRecord(this.value,false);
|
|
}
|
|
);
|
|
enableCheckboxActions();
|
|
return false;
|
|
});
|
|
|
|
$("#itemst").dataTable($.extend(true, {}, dataTablesDefaults, {
|
|
"aaSorting": [[ 1, "asc" ]],
|
|
"aoColumnDefs": [
|
|
{ "aTargets": [ 0,-1 ], "bSortable": false, "bSearchable": false }
|
|
],
|
|
"aoColumns": [
|
|
null,
|
|
{ "sType": "anti-the" },
|
|
null,
|
|
null,
|
|
null
|
|
]
|
|
}));
|
|
|
|
$(".cb").click(function(){
|
|
enableCheckboxActions();
|
|
});
|
|
enableCheckboxActions();
|
|
});
|
|
|
|
function enableCheckboxActions(){
|
|
// Enable/disable controls if checkboxes are checked
|
|
var checkedBoxes = $(".checkboxed input:checkbox:checked");
|
|
if ($(checkedBoxes).size()) {
|
|
$("#selections").html(_("With selected titles: "));
|
|
$("#selections-toolbar .links a").removeClass("disabled");
|
|
} else {
|
|
$("#selections").html(_("Select titles to: "));
|
|
$("#selections-toolbar .links a").addClass("disabled");
|
|
}
|
|
}
|
|
//]]>
|
|
</script>
|
|
[% END # / IF print_basket %]
|
|
[% END # / BLOCK jsinclude %]
|