dcd1f5d48c
Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
203 lines
7.6 KiB
Text
203 lines
7.6 KiB
Text
[% INCLUDE 'doc-head-open.inc' %]
|
|
<title>Koha › Tools</title>
|
|
[% INCLUDE 'doc-head-close.inc' %]
|
|
</head>
|
|
<body id="tools_tools-home" class="tools">
|
|
[% INCLUDE 'header.inc' %]
|
|
[% INCLUDE 'cat-search.inc' %]
|
|
|
|
<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> › Tools</div>
|
|
|
|
<div class="container-fluid">
|
|
<div class="row">
|
|
<div class="col-sm-4">
|
|
<h3>Patrons and circulation</h3>
|
|
<dl>
|
|
[% IF (CAN_user_tools_manage_patron_lists) %]
|
|
<dt><a href="/cgi-bin/koha/patron_lists/lists.pl">Patron lists</a>
|
|
<dd>Manage lists of patrons.</dd>
|
|
[% END %]
|
|
|
|
[% IF (CAN_user_clubs) %]
|
|
<dt><a href="/cgi-bin/koha/clubs/clubs.pl">Patron clubs</a>
|
|
<dd>Manage patron clubs..</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_moderate_comments ) %]
|
|
<dt><a href="/cgi-bin/koha/reviews/reviewswaiting.pl">Comments</a> [% IF ( pendingcomments ) %]<span class="number_box"><a href="/cgi-bin/koha/reviews/reviewswaiting.pl">[% pendingcomments | html %]</a></span>[% END %]</dt>
|
|
<dd>Moderate patron comments. </dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_import_patrons ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/import_borrowers.pl">Import patrons</a></dt>
|
|
<dd>Import patron data</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_edit_notices ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/letter.pl">Notices & slips</a></dt>
|
|
<dd>Define notices (print and email notification messages for overdues, etc.)</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_edit_notice_status_triggers ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/overduerules.pl">Overdue notice/status triggers</a></dt>
|
|
<dd>Set notice/status triggers for overdue items</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_label_creator ) %]
|
|
<dt><a href="/cgi-bin/koha/patroncards/home.pl">Patron card creator</a></dt>
|
|
<dd>Create printable patron cards</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_delete_anonymize_patrons ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/cleanborrowers.pl">Batch patron deletion/anonymization</a></dt>
|
|
<dd>Batch delete patrons and delete patron circulation history</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_edit_patrons ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/modborrowers.pl">Batch patron modification</a></dt>
|
|
<dd>Modify patrons in batch</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_moderate_tags ) %]
|
|
<dt><a href="/cgi-bin/koha/tags/review.pl">Tags</a> [% IF ( pendingtags ) %]<span class="number_box"><a href="/cgi-bin/koha/tags/review.pl">[% pendingtags | html %]</a></span>[% END %]</dt>
|
|
<dd>Moderate patron tags</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_batch_upload_patron_images ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/picture-upload.pl">Upload patron images</a></dt>
|
|
<dd>Upload patron images in a batch or one at a time</dd>
|
|
[% END %]
|
|
</dl>
|
|
</div>
|
|
|
|
|
|
<div class="col-sm-4 col-sm-push-4">
|
|
<h3>Additional tools</h3>
|
|
<dl>
|
|
[% IF ( CAN_user_tools_edit_calendar ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/holidays.pl">Calendar</a></dt>
|
|
<dd>Define days when the library is closed</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_manage_csv_profiles ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/csv-profiles.pl">CSV profiles</a></dt>
|
|
<dd>Manage CSV export profiles</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_view_system_logs ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/viewlog.pl">Log viewer</a></dt>
|
|
<dd>Browse the system logs</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_edit_news ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/koha-news.pl">News</a></dt>
|
|
<dd>Write news for the OPAC and staff interfaces</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_schedule_tasks ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/scheduler.pl">Task scheduler</a></dt>
|
|
<dd>Schedule tasks to run</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_edit_quotes ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/quotes.pl">Edit quotes for QOTD feature</a></dt>
|
|
<dd>Quote editor for Quote-of-the-day feature in OPAC</dd>
|
|
[% END %]
|
|
|
|
[% IF ( UseKohaPlugins && CAN_user_plugins_tool ) %]
|
|
<dt><a href="/cgi-bin/koha/plugins/plugins-home.pl?method=tool">Tool plugins</a></dt>
|
|
<dd>Use tool plugins</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_upload_general_files ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/upload.pl">Upload</a></dt>
|
|
<dd>Upload any type of file, manage uploads</dd>
|
|
[% END %]
|
|
|
|
[% IF CAN_user_tools_access_files %]
|
|
<dt><a href="/cgi-bin/koha/tools/access_files.pl">Access files</a></dt>
|
|
<dd>Access files stored on the server, like log files or reports</dd>
|
|
[% END %]
|
|
|
|
</dl>
|
|
</div>
|
|
|
|
<div class="col-sm-4 col-sm-pull-4">
|
|
<h3>Catalog</h3>
|
|
<dl>
|
|
[% IF ( CAN_user_tools_items_batchdel ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/batchMod.pl?del=1">Batch item deletion</a></dt>
|
|
<dd>Delete a batch of items</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_items_batchmod ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/batchMod.pl">Batch item modification</a></dt>
|
|
<dd>Modify items in a batch</dd>
|
|
[% END %]
|
|
|
|
[% IF CAN_user_tools_records_batchdel %]
|
|
<dt><a href="/cgi-bin/koha/tools/batch_delete_records.pl">Batch record deletion</a></dt>
|
|
<dd>Delete a batch of records (bibliographic or authority)</dd>
|
|
[% END %]
|
|
|
|
[% IF CAN_user_tools_records_batchmod %]
|
|
<dt><a href="/cgi-bin/koha/tools/batch_record_modification.pl">Batch record modification</a></dt>
|
|
<dd>Modify a batch of records (biblios or authorities)</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_items_batchmod ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/automatic_item_modification_by_age.pl">Automatic item modifications by age</a></dt>
|
|
<dd>Define rules to modify items by age</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_export_catalog ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/export.pl">Export data</a></dt>
|
|
<dd>Export bibliographic, holdings, and authority records</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_inventory ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/inventory.pl">Inventory</a></dt>
|
|
<dd>Perform inventory of your catalog</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_label_creator ) %]
|
|
<dt><a href="/cgi-bin/koha/labels/label-home.pl">Label creator</a></dt>
|
|
<dd>Create printable labels and barcodes from catalog data</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_label_creator ) %]
|
|
<dt><a href="/cgi-bin/koha/labels/spinelabel-home.pl">Quick spine label creator</a></dt>
|
|
<dd>Enter a barcode to generate a printable spine label. For use with dedicated label printers</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_rotating_collections ) %]
|
|
<dt><a href="/cgi-bin/koha/rotating_collections/rotatingCollections.pl">Rotating collections</a></dt>
|
|
<dd>Manage rotating collections</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_marc_modification_templates ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/marc_modification_templates.pl">MARC modification templates</a></dt>
|
|
<dd>Manage templates for modifying MARC records during import.</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_stage_marc_import ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/stage-marc-import.pl">Stage MARC records for import</a></dt>
|
|
<dd>Stage MARC records into the reservoir.</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_manage_staged_marc ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/manage-marc-import.pl">Staged MARC record management</a></dt>
|
|
<dd>Managed staged MARC records, including completing and reversing imports</dd>
|
|
[% END %]
|
|
|
|
[% IF ( CAN_user_tools_upload_local_cover_images ) %]
|
|
<dt><a href="/cgi-bin/koha/tools/upload-cover-image.pl">Upload local cover image</a></dt>
|
|
<dd>Utility to upload scanned cover images for display in OPAC</dd>
|
|
[% END %]
|
|
|
|
</dl>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
[% INCLUDE 'intranet-bottom.inc' %]
|