dcd1f5d48c
Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
237 lines
9.5 KiB
Text
237 lines
9.5 KiB
Text
[% SET footerjs = 1 %]
|
|
[% INCLUDE 'doc-head-open.inc' %]
|
|
<title>Koha › Serials › Frequencies</title>
|
|
[% INCLUDE 'doc-head-close.inc' %]
|
|
</head>
|
|
|
|
<body id="ser_subscription_frequencies" class="ser">
|
|
[% INCLUDE 'header.inc' %]
|
|
[% INCLUDE 'serials-search.inc' %]
|
|
|
|
[% BLOCK translate_frequnit %]
|
|
[% SWITCH frequnit %]
|
|
[% CASE 'day' %] day
|
|
[% CASE 'week' %] week
|
|
[% CASE 'month' %] month
|
|
[% CASE 'year' %] year
|
|
[% END %]
|
|
[% END %]
|
|
|
|
<div id="breadcrumbs">
|
|
<a href="/cgi-bin/koha/mainpage.pl">Home</a> ›
|
|
<a href="/cgi-bin/koha/serials/serials-home.pl">Serials</a> ›
|
|
<a href="/cgi-bin/koha/serials/subscription-frequencies.pl">Frequencies</a>
|
|
</div>
|
|
|
|
<div id="doc3" class="yui-t2">
|
|
|
|
<div id="bd">
|
|
<div id="yui-main">
|
|
<div class="yui-b">
|
|
[% IF (new or modify) %]
|
|
[% IF (new) %]
|
|
<h1>New frequency</h1>
|
|
[% ELSE %]
|
|
<h1>Edit frequency: [% description | html %]</h1>
|
|
[% END %]
|
|
<form action="/cgi-bin/koha/serials/subscription-frequencies.pl" id="add_frequency_form" method="post">
|
|
[% IF (modify) %]
|
|
<input type="hidden" name="id" value="[% id | html %]" />
|
|
<input type="hidden" name="op" value="savemod" />
|
|
[% ELSE %]
|
|
<input type="hidden" name="op" value="savenew" />
|
|
[% END %]
|
|
<fieldset class="rows">
|
|
<ol>
|
|
<li>
|
|
<label class="required" for="description">Description: </label>
|
|
<input type="text" id="description" name="description" value="[% description | html %]" class="required" required="required" /> <span class="required">Required</span>
|
|
</li>
|
|
<li>
|
|
<label for="unit">Unit: </label>
|
|
<select id="unit" name="unit">
|
|
<option value="">None</option>
|
|
[% FOREACH unit IN units_loop %]
|
|
[% IF (unit.selected) %]
|
|
<option selected="selected" value="[% unit.val | html %]">
|
|
[% ELSE %]
|
|
<option value="[% unit.val | html %]">
|
|
[% END %]
|
|
[% PROCESS translate_frequnit frequnit=unit.val %]
|
|
</option>
|
|
[% END %]
|
|
</select>
|
|
</li>
|
|
<li><span class="hint">Note: one of the two following fields must be equal to 1</span></li>
|
|
<li>
|
|
<label for="issuesperunit">Issues per unit: </label>
|
|
[% IF (new) %]
|
|
<input type="text" id="issuesperunit" name="issuesperunit" value="1" size="3" />
|
|
[% ELSE %]
|
|
<input type="text" id="issuesperunit" name="issuesperunit" value="[% issuesperunit | html %]" size="3" />
|
|
[% END %]
|
|
</li>
|
|
<li>
|
|
<label for="unitsperissue">Units per issue: </label>
|
|
[% IF (new) %]
|
|
<input type="text" id="unitsperissue" name="unitsperissue" value="1" size="3" />
|
|
[% ELSE %]
|
|
<input type="text" id="unitsperissue" name="unitsperissue" value="[% unitsperissue | html %]" size="3" />
|
|
[% END %]
|
|
</li>
|
|
<li>
|
|
<label for="displayorder">Display order: </label>
|
|
<input type="text" id="displayorder" name="displayorder" value="[% displayorder | html %]" size="3" />
|
|
</li>
|
|
</ol>
|
|
</fieldset>
|
|
<fieldset class="action">
|
|
<input type="submit" value="Save" />
|
|
<a href="/cgi-bin/koha/serials/subscription-frequencies.pl" class="cancel">Cancel</a>
|
|
</fieldset>
|
|
</form>
|
|
[% ELSE %]
|
|
|
|
<div id="toolbar" class="btn-toolbar">
|
|
<a class="btn btn-default btn-sm" id="newfrequency" href="/cgi-bin/koha/serials/subscription-frequencies.pl?op=new"><i class="fa fa-plus"></i> New frequency</a>
|
|
</div>
|
|
|
|
<h1>Frequencies</h1>
|
|
[% IF still_used %]
|
|
<div class="dialog alert">
|
|
<p>
|
|
This frequency is still used by [% subscriptions.size | html %]
|
|
subscription(s). Do you still want to delete it?
|
|
</p>
|
|
<p><a href="#" id="show_blocking_subs">Show subscriptions</a></p>
|
|
<ul id="blocking_subs" style="display:none">
|
|
[% FOREACH sub IN subscriptions %]
|
|
<li style="list-style-type:none">
|
|
<a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% sub.subscriptionid | html %]">[% sub.title | html %]</a>
|
|
</li>
|
|
[% END %]
|
|
</ul>
|
|
|
|
<form action="/cgi-bin/koha/serials/subscription-frequencies.pl" method="get">
|
|
<input type="hidden" name="op" value="del" />
|
|
<input type="hidden" name="confirm" value="1" />
|
|
<input type="hidden" name="frequencyid" value="[% frequencyid | html %]" />
|
|
<button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
|
|
</form>
|
|
<form action="/cgi-bin/koha/serials/subscription-frequencies.pl" method="get">
|
|
<button type="submit" class="deny"><i class="fa fa-fw fa-remove"></i> No, do not delete</button>
|
|
</form>
|
|
</div>
|
|
[% END %]
|
|
|
|
[% IF (frequencies_loop.size) %]
|
|
<table id="frequenciest">
|
|
<thead>
|
|
<tr>
|
|
<th>Description</th>
|
|
<th>Unit</th>
|
|
<th>Issues per unit</th>
|
|
<th>Units per issue</th>
|
|
<th>Display order</th>
|
|
<th>Actions</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
[% FOREACH frequency IN frequencies_loop %]
|
|
<tr>
|
|
<td>[% frequency.description | html %]</td>
|
|
<td>[% PROCESS translate_frequnit frequnit=frequency.unit %]</td>
|
|
<td>[% frequency.issuesperunit | html %]</td>
|
|
<td>[% frequency.unitsperissue | html %]</td>
|
|
<td>[% frequency.displayorder | html %]</td>
|
|
<td class="actions">
|
|
<a class="btn btn-default btn-xs" href="/cgi-bin/koha/serials/subscription-frequencies.pl?op=modify&frequencyid=[% frequency.id | html %]"><i class="fa fa-pencil"></i> Edit</a>
|
|
<a class="delete_frequency btn btn-default btn-xs" href="/cgi-bin/koha/serials/subscription-frequencies.pl?op=del&frequencyid=[% frequency.id | html %]"><i class="fa fa-trash"></i> Delete</a>
|
|
</td>
|
|
</tr>
|
|
[% END %]
|
|
</tbody>
|
|
</table>
|
|
[% ELSE %]
|
|
<p>There is no defined frequency.</p>
|
|
[% END %]
|
|
[% END %]
|
|
|
|
</div>
|
|
</div>
|
|
<div class="yui-b">
|
|
[% INCLUDE 'serials-menu.inc' %]
|
|
</div>
|
|
</div>
|
|
|
|
[% MACRO jsinclude BLOCK %]
|
|
<script type="text/javascript">
|
|
function confirmDelete() {
|
|
return confirm(_("Are you sure you want to delete this subscription frequency?"));
|
|
}
|
|
|
|
function check_form() {
|
|
var description = $("#description").val();
|
|
var unit = $("#unit").val();
|
|
var issuesperunit = $("#issuesperunit").val();
|
|
var unitsperissue = $("#unitsperissue").val();
|
|
var alert_msg = _("Some fields are not valid:") + "\n";
|
|
var errors = 0;
|
|
|
|
if(description.length == 0) {
|
|
alert_msg += "\t - " + _("Description is required");
|
|
errors ++;
|
|
}
|
|
if(unit.length > 0) {
|
|
if(isNaN(issuesperunit) || issuesperunit == 0) {
|
|
alert_msg += "\n\t - " + _("Issues per unit is required")
|
|
+ " " + _("(must be a number greater than 0)");
|
|
errors ++;
|
|
}
|
|
if(isNaN(unitsperissue) || unitsperissue == 0) {
|
|
alert_msg += "\n\t - " + _("Units per issue is required")
|
|
+ " " + _("(must be a number greater than 0)");
|
|
errors ++;
|
|
}
|
|
if(issuesperunit > 1 && unitsperissue > 1) {
|
|
alert_msg += "\n\t - " + _("One of 'issues per unit' and 'units per issue' must be equal to 1");
|
|
errors ++;
|
|
}
|
|
}
|
|
|
|
if(errors == 0) {
|
|
return true;
|
|
}
|
|
|
|
alert(alert_msg);
|
|
return false;
|
|
}
|
|
|
|
$(document).ready(function() {
|
|
$("#issuesperunit").change(function() {
|
|
var value = $(this).val();
|
|
if(!isNaN(value) && value > 1) {
|
|
$("#unitsperissue").val(1);
|
|
}
|
|
});
|
|
$("#unitsperissue").change(function() {
|
|
var value = $(this).val();
|
|
if(!isNaN(value) && value > 1) {
|
|
$("#issuesperunit").val(1);
|
|
}
|
|
});
|
|
$(".delete_frequency").on("click",function(){
|
|
return confirmDelete();
|
|
});
|
|
$("#add_frequency_form").on("submit",function(){
|
|
return check_form();
|
|
});
|
|
$("#show_blocking_subs").on("click",function(e){
|
|
e.preventDefault();
|
|
$("#blocking_subs").show();
|
|
});
|
|
});
|
|
</script>
|
|
[% END %]
|
|
|
|
[% INCLUDE 'intranet-bottom.inc' %]
|