dcd1f5d48c
Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
147 lines
6.5 KiB
Text
147 lines
6.5 KiB
Text
[% USE raw %]
|
|
[% USE Asset %]
|
|
[% PROCESS 'merge-record.inc' %]
|
|
[% SET footerjs = 1 %]
|
|
[% INCLUDE 'doc-head-open.inc' %]
|
|
<title>Koha › Cataloging › Merging records</title>
|
|
[% INCLUDE 'doc-head-close.inc' %]
|
|
<style type="text/css">
|
|
div.record ul, div.record li { float:none; display:block; }
|
|
div#result { margin-top: 1em; }
|
|
/* We use this style "against" the li ui-tabs-nav style automatically applied */
|
|
</style>
|
|
</head>
|
|
|
|
<body id="auth_merge" class="cat">
|
|
[% INCLUDE 'header.inc' %]
|
|
[% INCLUDE 'authorities-search.inc' %]
|
|
<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> › <a href="/cgi-bin/koha/authorities/authorities-home.pl">Authorities</a> › Merging records</div>
|
|
|
|
<div class="main container-fluid">
|
|
<div class="row">
|
|
<div class="col-md-8 col-md-offset-2">
|
|
|
|
<h1>Merging records</h1>
|
|
|
|
[% IF ( errors ) %]
|
|
|
|
[% FOREACH error IN errors %]
|
|
<div class="dialog alert">
|
|
[% IF error.code == 'WRONG_COUNT' %]
|
|
Number of records provided for merging: [% error.value | html %]. Currently only 2 records can be merged at a time.
|
|
[% ELSIF error.code == 'DESTRUCTIVE_MERGE' %]
|
|
You cannot merge a record with itself. Please select two different authorities.
|
|
[% ELSIF error.code == 'WRONG_FRAMEWORK' %]
|
|
The Default framework cannot be used, or the framework does not exist. Please select another framework for merging.
|
|
[% ELSIF error.code == 'EMPTY_MARC' %]
|
|
Sorry, but we did not find any MARC tags in the reference record.
|
|
[% ELSIF error.code == 'MISSING_RECORD' %]
|
|
Sorry, but we did not find a record for number: [% error.value | html %].
|
|
[% ELSE %]
|
|
[% error | html %]
|
|
[% END %]
|
|
</div>
|
|
[% END %]
|
|
|
|
[% ELSIF ( result ) %]
|
|
|
|
<script type="text/javascript">window.location.href="/cgi-bin/koha/authorities/detail.pl?authid=[% recordid1 | html %]"</script>
|
|
<p>The merging was successful. <a href="/cgi-bin/koha/authorities/detail.pl?authid=[% recordid1 | html %]">Click here to see the merged record.</a></p>
|
|
|
|
[% ELSIF ( choosereference ) %]
|
|
|
|
<p>Please choose which record will be the reference for the merge. The record chosen as reference will be kept, and the other will be deleted.</p>
|
|
<form id="mergeform" action="/cgi-bin/koha/authorities/merge.pl" method="post">
|
|
<fieldset class="rows">
|
|
<legend>Merge reference</legend>
|
|
<ol>
|
|
<li class="radio"><input type="radio" value="[% recordid1 | html %]" checked="checked" id="mergereference1" name="mergereference" onclick="changeFramework('[% frameworkcode1 | html %]')" /><label for="mergereference1">[% title1 | html %] [% FOREACH subtitl1 IN subtitle1 %] [% subtitl1.subfield | html %][% END %] (<a href="/cgi-bin/koha/authorities/detail.pl?authid=[% recordid1 | html %]" title="MARC" class="preview-merge-reference" target="_blank">[% recordid1 | html %][% IF frameworklabel1 %] — [% frameworklabel1 | html %][% END %]</a>)</label></li>
|
|
<li class="radio"><input type="radio" value="[% recordid2 | html %]" id="mergereference2" name="mergereference" onclick="changeFramework('[% frameworkcode2 | html %]')" /><label for="mergereference2">[% title2 | html %] [% FOREACH subtitl2 IN subtitle2 %] [% subtitl2.subfield | html %][% END %] (<a href="/cgi-bin/koha/authorities/detail.pl?authid=[% recordid2 | html %]" title="MARC" class="preview-merge-reference" target="_blank">[% recordid2 | html %][% IF frameworklabel2 %] — [% frameworklabel2 | html %][% END %]</a>)</label></li>
|
|
|
|
[% IF frameworkselect %]
|
|
<li><label for="frameworkcode">Using framework:</label>
|
|
<select name="frameworkcode" id="frameworkcode">
|
|
[% FOREACH frameworkcodeloo IN frameworkselect %]
|
|
[% IF frameworkcodeloo.authtypecode == frameworkcode1 %]
|
|
<option value="[% frameworkcodeloo.authtypecode | html %]" selected="selected">
|
|
[% ELSE %]
|
|
<option value="[% frameworkcodeloo.authtypecode | html %]">
|
|
[% END %]
|
|
[% frameworkcodeloo.authtypetext | html %]
|
|
</option>
|
|
[% END %]
|
|
</select></li>
|
|
[% END %]
|
|
</ol>
|
|
|
|
<input type="hidden" name="authid" value="[% recordid1 | html %]" />
|
|
<input type="hidden" name="authid" value="[% recordid2 | html %]" />
|
|
<fieldset class="action"><input type="submit" value="Next" /></fieldset>
|
|
</fieldset>
|
|
</form>
|
|
|
|
[% ELSE %]
|
|
|
|
<form id="mergeform" action="/cgi-bin/koha/authorities/merge.pl" method="post" onsubmit="return mergeformsubmit()">
|
|
|
|
<div class="yui-g">
|
|
<div class="yui-u first">
|
|
[% PROCESS mergesource sourcerecords=records %]
|
|
</div>
|
|
<div class="yui-u">
|
|
[% PROCESS mergetarget %]
|
|
</div> <!-- .yui-u -->
|
|
|
|
<input type="hidden" name="recordid1" value="[% recordid1 | html %]" />
|
|
<input type="hidden" name="recordid2" value="[% recordid2 | html %]" />
|
|
<input type="hidden" name="mergereference" value="[% mergereference | html %]" />
|
|
<input type="hidden" name="frameworkcode" value="[% framework | html %]" />
|
|
|
|
<fieldset class="action"><input type="submit" name="merge" value="Merge" /></fieldset>
|
|
</div>
|
|
</form>
|
|
|
|
[% END %]
|
|
|
|
</div>
|
|
|
|
[% MACRO jsinclude BLOCK %]
|
|
[% INCLUDE 'merge-record-strings.inc' %]
|
|
[% INCLUDE 'authorities_js.inc' %]
|
|
[% Asset.js("js/merge-record.js") | $raw %]
|
|
[% INCLUDE 'merge-record-strings.inc' %]
|
|
<script type="text/javascript">
|
|
//<![CDATA[
|
|
|
|
// When submiting the form
|
|
function mergeformsubmit() {
|
|
$('#tabs').remove();
|
|
}
|
|
|
|
$(document).ready(function(){
|
|
// Getting marc structure via ajax
|
|
tagslib = [];
|
|
$.getJSON("/cgi-bin/koha/authorities/merge_ajax.pl", {frameworkcode : "[% framework | html %]" }, function(json) {
|
|
tagslib = json;
|
|
rebuild_target($("#tabs"), $("#resultul"));
|
|
});
|
|
|
|
$('.preview-merge-reference').click(function (ev) {
|
|
ev.preventDefault();
|
|
newin=window.open($(this).attr('href'),'merge_reference', 'width=1000,height=600,toolbar=false,scrollbars=yes');
|
|
});
|
|
|
|
// Creating tabs
|
|
$("#tabs").tabs();
|
|
});
|
|
|
|
|
|
function changeFramework(fw) {
|
|
$("#Frameworks").val(fw);
|
|
}
|
|
|
|
//]]>
|
|
</script>
|
|
[% END %]
|
|
|
|
[% INCLUDE 'intranet-bottom.inc' %]
|