Koha/koha-tmpl/intranet-tmpl/prog/en/modules/admin/fieldmapping.tt
Katrin Fischer 624eb9e1f5 Bug 19108: (follow-up) Fix Stored XSS in fieldmapping.pl and items_search_fields.pl
To test:
- Add a framework with script in the description
- Access the Keywords to MARC mapping page
- Add an item search field where both name and label are script
- Try to edit/delete the added mapping

With the patch no script should be executed and everything
should still work ok.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-09-29 12:20:51 -03:00

88 lines
3.5 KiB
Text

[% INCLUDE 'doc-head-open.inc' %]
<title>Koha &rsaquo; Administration &rsaquo; Keyword to MARC mapping</title>
[% INCLUDE 'doc-head-close.inc' %]
<script type="text/javascript">
//<![CDATA[
$(document).ready(function() {
$('#selectframework').find("input:submit").hide();
$('#framework').change(function() {
$('#selectframework').submit();
});
});
//]]>
</script>
</head>
<body id="admin_fieldmapping" class="admin">
[% INCLUDE 'header.inc' %]
[% INCLUDE 'prefs-admin-search.inc' %]
<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo; Keyword to MARC mapping</div>
<div id="doc3" class="yui-t2">
<div id="yui-main">
<div class="yui-b">
<h2>Keyword to MARC mapping</h2>
[% UNLESS ( fields.count ) %]
<div class="dialog message"><p>There are no mappings for the [% IF framework.frameworktext %]<em>[% framework.frameworktext |html %]</em>[% ELSE %]default[% END %] framework. </p></div>
[% END %]
<form method="get" action="/cgi-bin/koha/admin/fieldmapping.pl" id="selectframework">
<label for="framework">Framework:</label>
<select name="framework" id="framework" style="width:20em;">
<option value="">Default</option>
[% FOREACH f IN frameworks %]
[% IF f.frameworkcode == framework.frameworkcode %]
<option selected="selected" value="[% f.frameworkcode %]">[% f.frameworktext |html %]</option>
[% ELSE %]
<option value="[% f.frameworkcode %]">[% f.frameworktext |html %]</option>
[% END %]
[% END %]
</select>
<input type="submit" value="Go" />
</form>
<form method="post" action="" id="addfield">
<input type="hidden" name="framework" value="[% framework.frameworkcode %]" />
<fieldset class="rows">
<legend>Add a mapping</legend>
<ol>
<li><label for="fieldname">Field name: </label><input type="text" id="fieldname" name="fieldname" /></li>
<li><label for="marcfield">MARC field: </label><input type="text" id="marcfield" name="marcfield" size="3" /></li>
<li><label for="marcsubfield">MARC subfield: </label><input type="text" id="marcsubfield" name="marcsubfield" size="1" /></li>
</ol>
<fieldset class="action">
<input type="submit" value="Submit" />
</fieldset>
</fieldset>
</form>
[% IF ( fields.count ) %]
<table>
<caption>Mappings for the [% IF framework.frameworktext %]<em>[% framework.frameworktext %]</em>[% ELSE %]default[% END %] framework</caption>
<tr>
<th>Field</th>
<th>MARC field</th>
<th>MARC subfield</th>
<th>&nbsp;</th>
</tr>
[% FOREACH field IN fields %]
<tr>
<td>[% field.field |html %]</td>
<td>[% field.fieldcode %]</td>
<td>[% field.subfieldcode %]</td>
<td><a class="btn btn-default btn-xs" href="?op=delete&amp;id=[% field.id %]&amp;framework=[% field.frameworkcode %]"><i class="fa fa-trash"></i> Delete</a></td>
</tr>
[% END %]
</table>[% END %]
</div>
</div>
<div class="yui-b">
[% INCLUDE 'admin-menu.inc' %]
</div>
[% INCLUDE 'intranet-bottom.inc' %]