dcd1f5d48c
Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
240 lines
10 KiB
Text
240 lines
10 KiB
Text
[% USE raw %]
|
|
[% USE Asset %]
|
|
[% SET footerjs = 1 %]
|
|
[% INCLUDE 'doc-head-open.inc' %]
|
|
<title>Koha › Localization</title>
|
|
[% INCLUDE 'doc-head-close.inc' popup => 1 %]
|
|
[% Asset.css("css/datatables.css") | $raw %]
|
|
</head>
|
|
|
|
<body id="admin_localization" class="admin">
|
|
<div id="main">
|
|
<form id="add_translation" method="post">
|
|
<input type="hidden" name="entity" value="[% entity | html %]" />
|
|
<input type="hidden" name="code" value="[% code | html %]" />
|
|
Lang: <select name="lang">
|
|
[% FOR language IN languages %]
|
|
[% FOR sublanguage IN language.sublanguages_loop %]
|
|
[% IF language.plural %]
|
|
<option value="[% sublanguage.rfc4646_subtag | html %]">[% sublanguage.native_description | html %] [% sublanguage.region_description | html %] ([% sublanguage.rfc4646_subtag | html %])</option>
|
|
[% ELSE %]
|
|
<option value="[% sublanguage.rfc4646_subtag | html %]">[% sublanguage.native_description | html %] ([% sublanguage.rfc4646_subtag | html %])</option>
|
|
[% END %]
|
|
[% END %]
|
|
[% END %]
|
|
</select>
|
|
Translation: <input type="text" name="translation" />
|
|
<input type="submit" value="Add" />
|
|
</form>
|
|
<div id="messages"></div>
|
|
<table id="localization">
|
|
<thead>
|
|
<tr>
|
|
<th>Id</th>
|
|
<th>Entity</th>
|
|
<th>Code</th>
|
|
<th>Lang</th>
|
|
<th>Translation</th>
|
|
<th></th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
[% FOR t IN translations %]
|
|
<tr id="row_id_[% t.id | html %]" data-id="[% t.id | html %]">
|
|
<td>[% t.id | html %]</td>
|
|
<td>[% t.entity | html %]</td>
|
|
<td>[% t.code | html %]</td>
|
|
<td class="lang">[% t.lang | html %]</td>
|
|
<td class="translation" contenteditable="true">[% t.translation | html %]</td>
|
|
<td class="actions"><a href="#" class="delete"><i class="fa fa-trash"></i> Delete</a></td>
|
|
</tr>
|
|
[% END %]
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
[% MACRO jsinclude BLOCK %]
|
|
[% INCLUDE 'datatables.inc' %]
|
|
<script type="text/javascript">
|
|
|
|
function show_message( params ) {
|
|
var type = params.type;
|
|
var data = params.data;
|
|
var messages = $("#messages");
|
|
var message;
|
|
if ( type == 'success_on_update' ) {
|
|
message = $('<div class="dialog message"></div>');
|
|
message.text("Entity %s (code %s) for lang %s has correctly been updated with '%s'".format(data.entity, data.code, data.lang, data.translation));
|
|
} else if ( type == 'error_on_update' ) {
|
|
message = $('<div class="dialog alert"></div>');
|
|
if ( data.error_code == 'already_exists' ) {
|
|
message.text("A translation already exists for this language.");
|
|
} else {
|
|
message.text("An error occurred when updating this translation.");
|
|
}
|
|
} else if ( type == 'success_on_delete' ) {
|
|
message = $('<div class="dialog message"></div>');
|
|
message.text("The translation (id %s) has been removed successfully".format(data.id));
|
|
} else if ( type == 'error_on_delete' ) {
|
|
message = $('<div class="dialog alert"></div>');
|
|
message.text("An error occurred when deleting this translation");
|
|
} else if ( type == 'success_on_insert' ) {
|
|
message = $('<div class="dialog message"></div>');
|
|
message.text("Translation (id %s) has been added successfully".format(data.id));
|
|
} else if ( type == 'error_on_insert' ) {
|
|
message = $('<div class="dialog alert"></div>');
|
|
if ( data.error_code == 'already_exists' ) {
|
|
message.text("A translation already exists for this language.");
|
|
} else {
|
|
message.text("An error occurred when adding this translation");
|
|
}
|
|
}
|
|
|
|
$(messages).append(message);
|
|
|
|
setTimeout(function(){
|
|
message.hide()
|
|
}, 3000);
|
|
}
|
|
|
|
function send_update_request( data, cell ) {
|
|
$.ajax({
|
|
data: data,
|
|
type: 'PUT',
|
|
url: '/cgi-bin/koha/svc/localization',
|
|
success: function (data) {
|
|
if ( data.error ) {
|
|
$(cell).css('background-color', '#FF0000');
|
|
show_message({ type: 'error_on_update', data: data });
|
|
} else if ( data.is_changed == 1 ) {
|
|
$(cell).css('background-color', '#00FF00');
|
|
show_message({ type: 'success_on_update', data: data });
|
|
}
|
|
|
|
if ( $(cell).hasClass('lang') ) {
|
|
$(cell).text(data.lang)
|
|
} else if ( $(cell).hasClass('translation') ) {
|
|
$(cell).text(data.translation)
|
|
}
|
|
},
|
|
error: function (data) {
|
|
$(cell).css('background-color', '#FF0000');
|
|
if ( $(cell).hasClass('lang') ) {
|
|
$(cell).text(data.lang)
|
|
} else if ( $(cell).hasClass('translation') ) {
|
|
$(cell).text(data.translation)
|
|
}
|
|
show_message({ type: 'error_on_update', data: data });
|
|
},
|
|
});
|
|
}
|
|
|
|
function send_delete_request( id, cell ) {
|
|
$.ajax({
|
|
type: 'DELETE',
|
|
url: '/cgi-bin/koha/svc/localization/?id='+id,
|
|
success: function (data) {
|
|
$("#localization").DataTable().row( '#row_id_' + id ).remove().draw();
|
|
show_message({ type: 'success_on_delete', data: data });
|
|
},
|
|
error: function (data) {
|
|
$(cell).css('background-color', '#FF0000');
|
|
show_message({ type: 'error_on_delete', data: data });
|
|
},
|
|
});
|
|
}
|
|
|
|
$(document).ready(function() {
|
|
$(".dialog").hide();
|
|
|
|
var table = $("#localization").DataTable($.extend(true, {}, dataTablesDefaults, {
|
|
'bPaginate': false,
|
|
}));
|
|
|
|
var languages_select = $('<select name="lang"></select>');
|
|
[% FOR language IN languages %]
|
|
[% FOR sublanguage IN language.sublanguages_loop %]
|
|
var option;
|
|
[% IF language.plural %]
|
|
option = $('<option value="[% sublanguage.rfc4646_subtag | html %]">[% sublanguage.native_description | html %] [% sublanguage.region_description | html %] ([% sublanguage.rfc4646_subtag | html %])</option>');
|
|
$(languages_select).append(option);
|
|
[% ELSE %]
|
|
option = $('<option value="[% sublanguage.rfc4646_subtag | html %]">[% sublanguage.native_description | html %] ([% sublanguage.rfc4646_subtag | html %])</option>');
|
|
[% END %]
|
|
$(languages_select).append(option);
|
|
[% END %]
|
|
[% END %]
|
|
|
|
$("td.translation").on('focus', function(){
|
|
$(this).css('background-color', '');
|
|
});
|
|
$("td.lang").on('click', function(){
|
|
var td = this;
|
|
var lang = $(td).text();
|
|
$(td).css('background-color', '');
|
|
var my_select = $(languages_select).clone();
|
|
$(my_select).find('option[value="' + lang + '"]').attr('selected', 'selected');
|
|
$(my_select).on('click', function(e){
|
|
e.stopPropagation();
|
|
});
|
|
$(my_select).on('change', function(){
|
|
var tr = $(this).parent().parent();
|
|
var id = $(tr).data('id');
|
|
var lang = $(this).find('option:selected').val();
|
|
var data = "id=" + encodeURIComponent(id) + "&lang=" + encodeURIComponent(lang);
|
|
send_update_request( data, td );
|
|
});
|
|
$(my_select).on('blur', function(){
|
|
$(td).html(lang);
|
|
});
|
|
$(this).html(my_select);
|
|
});
|
|
|
|
$("td.translation").on('blur', function(){
|
|
var tr = $(this).parent();
|
|
var id = $(tr).data('id');
|
|
var translation = $(this).text();
|
|
var data = "id=" + encodeURIComponent(id) + "&translation=" + encodeURIComponent(translation);
|
|
send_update_request( data, this );
|
|
});
|
|
|
|
$("a.delete").on('click', function(e){
|
|
e.preventDefault();
|
|
if ( confirm(_("Are you sure you want to delete this translation?")) ) {
|
|
var td = $(this).parent();
|
|
var tr = $(td).parent();
|
|
var id = $(tr).data('id');
|
|
send_delete_request( id, td );
|
|
}
|
|
});
|
|
|
|
$("#add_translation").on('submit', function(e){
|
|
e.preventDefault();
|
|
var entity = $(this).find('input[name="entity"]').val();
|
|
var code = $(this).find('input[name="code"]').val();
|
|
var lang = $(this).find('select[name="lang"] option:selected').val();
|
|
var translation = $(this).find('input[name="translation"]').val();
|
|
var data = "entity=" + encodeURIComponent(entity) + "&code=" + encodeURIComponent(code) + "&lang=" + encodeURIComponent(lang) + "&translation=" + encodeURIComponent(translation);
|
|
$.ajax({
|
|
data: data,
|
|
type: 'POST',
|
|
url: '/cgi-bin/koha/svc/localization',
|
|
success: function (data) {
|
|
if ( data.error ) {
|
|
show_message({ type: 'error_on_insert', data: data });
|
|
} else {
|
|
// FIXME Should append the delete link
|
|
table.row.add( [ data.id, data.entity, data.code, data.lang, data.translation, "" ] ).draw();
|
|
show_message({ type: 'success_on_insert', data: data });
|
|
}
|
|
},
|
|
error: function (data) {
|
|
show_message({ type: 'error_on_insert', data: data });
|
|
},
|
|
});
|
|
});
|
|
|
|
});
|
|
</script>
|
|
[% END %]
|
|
[% INCLUDE 'popup-bottom.inc' %]
|