dcd1f5d48c
Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
230 lines
10 KiB
Text
230 lines
10 KiB
Text
[% USE raw %]
|
|
[% USE Asset %]
|
|
[% SET footerjs = 1 %]
|
|
[% INCLUDE 'doc-head-open.inc' %]
|
|
<title>Koha › Tools › Batch item deletion</title>
|
|
[% INCLUDE 'doc-head-close.inc' %]
|
|
[% Asset.css("css/datatables.css") | $raw %]
|
|
<!--[if IE]>
|
|
<style type="text/css">#selections { display: none; }</style>
|
|
<![endif]-->
|
|
</head>
|
|
<body id="tools_batchMod-del" class="tools">
|
|
[% INCLUDE 'header.inc' %]
|
|
[% INCLUDE 'cat-search.inc' %]
|
|
|
|
<div id="breadcrumbs">
|
|
<a href="/cgi-bin/koha/mainpage.pl">Home</a> ›
|
|
<a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> ›
|
|
<a href="/cgi-bin/koha/tools/batchMod.pl?del=1">Batch item deletion</a>
|
|
</div>
|
|
|
|
<div class="main container-fluid">
|
|
|
|
[% IF ( show ) %]<h1>Batch item deletion</h1>[% ELSE %]<h1>Batch item deletion results</h1>[% END %]
|
|
[% IF ( barcode_not_unique ) %]<div class="dialog alert"><strong>Error saving item</strong>: Barcode must be unique.</div>[% END %]
|
|
[% IF ( no_next_barcode ) %]<div class="dialog alert"><strong>Error saving items</strong>: Unable to automatically determine values for barcodes. No item has been inserted.</div>[% END %]
|
|
[% IF ( book_on_loan ) %]<div class="dialog alert"><strong>Cannot delete</strong>: item is checked out.</div>[% END %]
|
|
[% IF ( book_reserved ) %]<div class="dialogalert"><strong>Cannot delete</strong>: item has a waiting hold.</div>[% END %]
|
|
|
|
[% UNLESS ( action ) %]
|
|
|
|
[% IF ( notfoundbarcodes.size ) %]
|
|
<div class="dialog alert">
|
|
[% IF ( itemresults ) %]<p>Warning, the following barcodes were not found:</p>[% ELSE %]<p>Warning: no barcodes were found</p>[% END %]
|
|
</div>
|
|
<table style="margin:auto;">
|
|
<thead>
|
|
<tr><th>Barcodes not found</th></tr>
|
|
</thead>
|
|
<tbody>
|
|
[% FOREACH notfoundbarcode IN notfoundbarcodes %]
|
|
<tr><td>[% notfoundbarcode |html %]</td></td>
|
|
[% END %]
|
|
</tbody>
|
|
</table>
|
|
[% IF ( item_loop ) %]
|
|
[% UNLESS ( too_many_items ) %]
|
|
<h4>The following barcodes were found: </h4>
|
|
[% END %]
|
|
[% END %]
|
|
[% END %] <!-- /notfoundbarcodes -->
|
|
[% IF ( notfounditemnumbers.size ) %]
|
|
<div class="dialog alert">
|
|
[% IF ( itemresults ) %]<p>Warning, the following itemnumbers were not found:</p>[% ELSE %]<p>Warning: no itemnumbers were found</p>[% END %]
|
|
</div>
|
|
<table style="margin:auto;">
|
|
<thead>
|
|
<tr><th>Itemnumbers not found</th></tr>
|
|
</thead>
|
|
<tbody>
|
|
[% FOREACH notfounditemnumber IN notfounditemnumbers %]
|
|
<tr><td>[% notfounditemnumber |html %]</td></td>
|
|
[% END %]
|
|
</tbody>
|
|
</table>
|
|
[% IF ( item_loop ) %]
|
|
[% UNLESS ( too_many_items ) %]
|
|
<h4>The following itemnumbers were found: </h4>
|
|
[% END %]
|
|
[% END %]
|
|
[% END %] <!-- /notfounditemnumbers -->
|
|
|
|
|
|
|
|
|
|
<form name="f" action="batchMod.pl" method="post">
|
|
<input type="hidden" name="biblionumber" id="biblionumber" value="[% biblionumber | html %]" />
|
|
<input type="hidden" name="op" value="[% op | html %]" />
|
|
<input type="hidden" name="uploadedfileid" id="uploadedfileid" value="" />
|
|
<input type="hidden" name="completedJobID" id="completedJobID" value="" />
|
|
<input type="hidden" name="src" id="src" value="[% src | html %]" />
|
|
[% IF biblionumber %]
|
|
<input type="hidden" name="biblionumber" id="biblionumber" value="[% biblionumber | html %]" />
|
|
[% END %]
|
|
|
|
[% IF ( item_loop ) %]
|
|
[% IF ( show ) %]<div id="toolbar"><a id="selectallbutton" href="#"><i class="fa fa-check"></i> Select all</a> | <a id="clearallbutton" href="#"><i class="fa fa-remove"></i> Clear all</a></div>[% END %]
|
|
<div id="cataloguing_additem_itemlist">
|
|
|
|
<p id="selections"><strong>Show/hide columns:</strong> <span class="selected"><input type="checkbox" checked="checked" id="showall"/><label for="showall">Show all columns</label></span> <span><input type="checkbox" id="hideall"/><label for="hideall">Hide all columns</label></span>
|
|
[% FOREACH item_header_loo IN item_header_loop %]
|
|
<span class="selected"><input id="checkheader[% loop.count | html %]" type="checkbox" checked="checked" /> <label for="checkheader[% loop.count | html %]">[% item_header_loo.header_value | html %]</label> </span>
|
|
[% END %]
|
|
</p>
|
|
|
|
<table id="itemst">
|
|
<thead>
|
|
<tr>
|
|
[% IF ( show ) %]<th> </th>[% END %]
|
|
<th class="anti-the">Title</th>
|
|
[% FOREACH item_header_loo IN item_header_loop %]
|
|
<th> [% item_header_loo.header_value | html %] </th>
|
|
[% END %]
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
[% FOREACH item_loo IN item_loop %] <tr> [% IF ( show ) %][% IF ( item_loo.nomod ) %] <td class="error">Cannot edit</td>[% ELSE %]<td><input type="checkbox" name="itemnumber" value="[% item_loo.itemnumber | html %]" id="row[% item_loo.itemnumber | html %]" checked="checked" /></td>[% END %][% END %]
|
|
<td><label for="row[% item_loo.itemnumber | html %]"><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% item_loo.biblionumber | html %]">[% item_loo.title | html %]</a>[% IF ( item_loo.author ) %], by [% item_loo.author | html %][% END %]</label></td>
|
|
[% FOREACH item_valu IN item_loo.item_value %] <td>[% item_valu.field | html %]</td>
|
|
[% END %] </tr>
|
|
[% END %]
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
[% END %]
|
|
|
|
[% IF ( simple_items_display ) %]
|
|
<ul>
|
|
[% FOREACH simple_items_displa IN simple_items_display %]
|
|
<li>
|
|
<a href="[% simple_items_displa.itemnumber | html %]">[% simple_items_displa.barcode | html %]</a>
|
|
</li>
|
|
[% END %]
|
|
</ul>
|
|
[% END %]
|
|
|
|
|
|
[% IF ( show ) %]
|
|
|
|
[% IF ( too_many_items ) %]
|
|
<p>Too many items ([% too_many_items | html %]) to display individually.</p>
|
|
[% FOREACH itemnumber IN itemnumbers_array %]
|
|
<input type="hidden" name="itemnumber" value="[% itemnumber | html %]" />
|
|
[% END %]
|
|
[% END %]
|
|
|
|
[% IF ( itemresults ) %]
|
|
<div id="cataloguing_additem_newitem">
|
|
<input type="hidden" name="op" value="[% op | html %]" />
|
|
<p>This will delete [% IF ( too_many_items ) %]all the[% ELSE %]the selected[% END %] items.</p>
|
|
<input type="hidden" name="del" value="1" />
|
|
<fieldset class="action">
|
|
<input type="checkbox" name="del_records" id="del_records" /> <label for="del_records">Delete records if no items remain.</label>
|
|
[% IF too_many_items %]
|
|
<input type="submit" name="mainformsubmit" value="Delete ALL submitted items" />
|
|
[% ELSE %]
|
|
<input type="submit" name="mainformsubmit" value="Delete selected items" />
|
|
[% END %]
|
|
|
|
<a href="/cgi-bin/koha/tools/batchMod.pl?del=1" class="cancel">Cancel</a>
|
|
</fieldset>
|
|
</div>
|
|
[% ELSE %]
|
|
<p><a href="/cgi-bin/koha/tools/batchMod.pl?del=1">Return to batch item deletion</a></p>
|
|
[% END %]
|
|
[% END %]
|
|
</form>
|
|
[% END %]
|
|
|
|
[% IF ( action ) %]
|
|
<div class="dialog message">
|
|
<p>[% deleted_items | html %] item(s) deleted.</p>
|
|
[% IF delete_records %] <p>[% deleted_records | html %] record(s) deleted.</p> [% END %]
|
|
[% IF src == 'CATALOGUING' # from catalogue/detail.pl > Delete items in a batch%]
|
|
<a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber | html %]">Return to the record</a>
|
|
[% ELSIF src %]
|
|
<a href="[% src | html %]">Return to where you were</a>
|
|
[% ELSE %]
|
|
<a href="/cgi-bin/koha/tools/batchMod.pl?del=1">Return to batch item deletion</a>
|
|
[% END %]
|
|
</div>
|
|
[% IF ( not_deleted_items ) %]
|
|
<div style="width:55%;margin:auto;">
|
|
<p>[% not_deleted_items | html %] item(s) could not be deleted: [% FOREACH not_deleted_itemnumber IN not_deleted_itemnumbers %][% not_deleted_itemnumber.itemnumber | html %][% END %]</p>
|
|
[% IF ( not_deleted_loop ) %]
|
|
<table id="itemst">
|
|
<thead>
|
|
<tr>
|
|
<th>Itemnumber</th>
|
|
<th>Barcode</th>
|
|
<th>Reason</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
[% FOREACH not_deleted_loo IN not_deleted_loop %]
|
|
<tr>
|
|
<td>[% not_deleted_loo.itemnumber | html %]</td>
|
|
<td>[% IF ( CAN_user_editcatalogue_edit_items ) %]<a href="/cgi-bin/koha/cataloguing/additem.pl?op=edititem&biblionumber=[% not_deleted_loo.biblionumber | html %]&itemnumber=[% not_deleted_loo.itemnumber | html %]">[% not_deleted_loo.barcode | html %]</a>[% ELSE %][% not_deleted_loo.barcode | html %][% END %]</td>
|
|
<td>[% IF ( not_deleted_loo.book_on_loan ) %]Item is checked out[% ELSIF ( not_deleted_loo.book_reserved ) %]Item has a waiting hold[% END %]</td>
|
|
</tr>
|
|
[% END %]
|
|
</tbody>
|
|
</table>
|
|
[% END %]
|
|
</div>
|
|
[% END %]
|
|
|
|
<p>
|
|
[% IF src == 'CATALOGUING' # from catalogue/detail.pl > Delete items in a batch%]
|
|
<a class="btn btn-default" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber | html %]"><i class="fa fa-check-square-o"></i> Return to the record</a>
|
|
[% ELSIF src %]
|
|
<a class="btn btn-default" href="[% src | html %]"><i class="fa fa-check-square-o"></i> Return to where you were</a>
|
|
[% ELSE %]
|
|
<a class="btn btn-default" href="/cgi-bin/koha/tools/batchMod.pl?del=1"><i class="fa fa-check-square-o"></i> Return to batch item deletion</a>
|
|
[% END %]
|
|
</p>
|
|
[% END %]
|
|
</div>
|
|
|
|
[% MACRO jsinclude BLOCK %]
|
|
[% Asset.js("js/tools-menu.js") | $raw %]
|
|
[% INCLUDE 'datatables.inc' %]
|
|
[% Asset.js("js/pages/batchMod.js") | $raw %]
|
|
[% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
|
|
<script type="text/javascript">
|
|
// Prepare array of all column headers, incrementing each index by
|
|
// two to accommodate control and title columns
|
|
var allColumns = new Array([% FOREACH item_header_loo IN item_header_loop %]'[% loop.count | html %]'[% UNLESS ( loop.last ) %],[% END %][% END %]);
|
|
for( x=0; x<allColumns.length; x++ ){
|
|
allColumns[x] = Number(allColumns[x]) + 2;
|
|
}
|
|
$(document).ready(function(){
|
|
$("#mainformsubmit").on("click",function(){
|
|
return submitBackgroundJob(this.form);
|
|
});
|
|
});
|
|
</script>
|
|
[% END %]
|
|
|
|
[% INCLUDE 'intranet-bottom.inc' %]
|