dcd1f5d48c
Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
239 lines
14 KiB
Text
239 lines
14 KiB
Text
[% USE raw %]
|
|
[% USE Asset %]
|
|
[% USE AuthorisedValues %]
|
|
[% USE ItemTypes %]
|
|
[% USE Branches %]
|
|
[% SET footerjs = 1 %]
|
|
[% INCLUDE 'doc-head-open.inc' %]
|
|
<title>Koha › Course reserves › Course details for [% course.course_name | html %]</title>
|
|
[% INCLUDE 'doc-head-close.inc' %]
|
|
|
|
[% Asset.css("css/datatables.css") | $raw %]
|
|
</head>
|
|
|
|
<body id="courses_course_details" class="course">
|
|
|
|
[% INCLUDE 'header.inc' %]
|
|
[% INCLUDE 'cat-search.inc' %]
|
|
|
|
<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> › <a href="/cgi-bin/koha/course_reserves/course-reserves.pl">Course reserves</a> › Course details for <i>[% course.course_name | html %]</i></div>
|
|
|
|
<div class="main container-fluid">
|
|
<div class="row">
|
|
<div class="col-md-8 col-md-offset-2">
|
|
|
|
[% IF CAN_user_coursereserves_add_reserves OR CAN_user_coursereserves_manage_courses OR CAN_user_coursereserves_manage_courses %]
|
|
<div id="toolbar">
|
|
[% IF CAN_user_coursereserves_add_reserves %]
|
|
<a class="btn btn-default btn-sm" id="add_items" href="/cgi-bin/koha/course_reserves/add_items.pl?course_id=[% course.course_id | html %]"><i class="fa fa-plus"></i> Add reserves</a>
|
|
<a class="btn btn-default btn-sm" id="add_items" href="/cgi-bin/koha/course_reserves/batch_add_items.pl?course_id=[% course.course_id | html %]"><i class="fa fa-plus"></i> Batch add reserves</a>
|
|
[% END %]
|
|
[% IF ( CAN_user_coursereserves_manage_courses ) %]
|
|
<a class="btn btn-default btn-sm" id="edit_course" href="/cgi-bin/koha/course_reserves/course.pl?course_id=[% course.course_id | html %]"><i class="fa fa-pencil"></i> Edit course</a>
|
|
[% END %]
|
|
[% IF ( CAN_user_coursereserves_manage_courses ) %]
|
|
<a class="btn btn-default btn-sm" id="delete_course" href="/cgi-bin/koha/course_reserves/mod_course.pl?course_id=[% course.course_id | html %]&action=del"><i class="fa fa-trash"></i> Delete course</a>
|
|
[% END %]
|
|
</div><!-- /toolbar -->
|
|
[% END %]
|
|
|
|
<div class="rows">
|
|
<ol>
|
|
<li><span class="label">Course name</span> [% course.course_name | html %]</li>
|
|
<li><span class="label">Term</span> [% AuthorisedValues.GetByCode( 'TERM', course.term ) | html %]</li>
|
|
<li><span class="label">Department</span> [% AuthorisedValues.GetByCode( 'DEPARTMENT', course.department ) | html %]</li>
|
|
<li><span class="label">Course number</span> [% course.course_number | html %]</li>
|
|
<li><span class="label">Section</span> [% course.section | html %]</li>
|
|
<li><span class="label">Instructors</span> [% FOREACH i IN course.instructors %]<div class="instructor"><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% i.borrowernumber | html %]">[% i.firstname | html %] [% i.surname | html %]</a></div>[% END %]</li>
|
|
<li><span class="label">Staff note</span> [% course.staff_note | html %]</li>
|
|
<li><span class="label">Public note</span> [% course.public_note | html %]</li>
|
|
<li><span class="label">Student count</span> [% course.students_count | html %]</li>
|
|
<li><span class="label">Status</span> [% IF course.enabled == 'yes' %]Active[% ELSE %]Inactive[% END %]</li>
|
|
</ol>
|
|
</div>
|
|
|
|
[% IF course_reserves %]
|
|
<table id="course_reserves_table">
|
|
<caption>Reserves</caption>
|
|
<thead>
|
|
<tr>
|
|
<th class="antithe">Title</th>
|
|
<th>Author</th>
|
|
<th>Barcode</th>
|
|
<th>Call number</th>
|
|
[% IF item_level_itypes %]<th>Item type</th>[% END %]
|
|
<th>Collection</th>
|
|
<th>Location</th>
|
|
<th>Library</th>
|
|
<th>Staff note</th>
|
|
<th>Public note</th>
|
|
<th>Link</th>
|
|
<th class="NoSort">Other course reserves</th>
|
|
[% IF CAN_user_coursereserves_add_reserves || CAN_user_coursereserves_delete_reserves %]
|
|
<th class="NoSort">Actions</th>
|
|
[% END %]
|
|
</tr>
|
|
</thead>
|
|
|
|
<tbody>
|
|
[% FOREACH cr IN course_reserves %]
|
|
<tr>
|
|
<td><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% cr.biblio.biblionumber | html %]">[% cr.biblio.title | html %]</a></td>
|
|
<td>[% cr.biblio.author | html %]</td>
|
|
<td><a href="/cgi-bin/koha/catalogue/moredetail.pl?itemnumber=[% cr.item.itemnumber | html %]&biblionumber=[% cr.biblio.biblionumber | html %]&bi=[% cr.biblioitem.biblioitemnumber | html %]">[% cr.item.barcode | html %]</a></td>
|
|
<td>[% cr.item.itemcallnumber | html %]</td>
|
|
[% IF item_level_itypes %]
|
|
<td>
|
|
[% IF cr.course_item.itype %]
|
|
[% IF cr.course_item.enabled == 'yes' %]
|
|
[% ItemTypes.GetDescription( cr.item.itype ) | html %]
|
|
[% ELSE %]
|
|
[% ItemTypes.GetDescription( cr.course_item.itype ) | html %]
|
|
[% END %]
|
|
[% ELSE %]
|
|
<i>Unchanged</i>
|
|
[% IF cr.item.itype %]
|
|
([% ItemTypes.GetDescription( cr.item.itype ) | html %])
|
|
[% END %]
|
|
[% END %]
|
|
</td>
|
|
[% END %]
|
|
<td>
|
|
[% IF cr.course_item.ccode %]
|
|
[% IF cr.course_item.enabled == 'yes' %]
|
|
[% AuthorisedValues.GetByCode( 'CCODE', cr.item.ccode ) | html %]
|
|
[% ELSE %]
|
|
[% AuthorisedValues.GetByCode( 'CCODE', cr.course_item.ccode ) | html %]
|
|
[% END %]
|
|
[% ELSE %]
|
|
<i>Unchanged</i>
|
|
[% IF cr.item.ccode %]
|
|
([% AuthorisedValues.GetByCode( 'CCODE', cr.item.ccode ) | html %])
|
|
[% END %]
|
|
[% END %]
|
|
</td>
|
|
<td>
|
|
[% IF cr.course_item.location %]
|
|
[% IF cr.course_item.enabled == 'yes' %]
|
|
[% AuthorisedValues.GetByCode( 'LOC', cr.item.location ) | html %]
|
|
[% ELSE %]
|
|
[% AuthorisedValues.GetByCode( 'LOC', cr.course_item.location ) | html %]
|
|
[% END %]
|
|
[% ELSE %]
|
|
<i>Unchanged</i>
|
|
[% IF cr.item.location %]
|
|
([% AuthorisedValues.GetByCode( 'LOC', cr.item.location ) | html %])
|
|
[% END %]
|
|
[% END %]
|
|
</td>
|
|
<td>
|
|
[% IF cr.course_item.holdingbranch %]
|
|
[% IF cr.course_item.enabled == 'yes' %]
|
|
[% Branches.GetName( cr.item.holdingbranch ) | html %]
|
|
[% ELSE %]
|
|
[% Branches.GetName( cr.course_item.holdingbranch ) | html %]
|
|
[% END %]
|
|
[% ELSE %]
|
|
<i>Unchanged</i>
|
|
[% IF cr.item.holdingbranch %]
|
|
([% Branches.GetName( cr.item.holdingbranch ) | html %])
|
|
[% END %]
|
|
[% END %]
|
|
</td>
|
|
<td>[% IF (cr.staff_note) %]
|
|
[% cr.staff_note | html %]
|
|
[% ELSIF (cr.item.itemnotes_nonpublic) %]
|
|
[% cr.item.itemnotes_nonpublic | html %]
|
|
[% END %]
|
|
</td>
|
|
<td>[% IF (cr.public_note) %]
|
|
[% cr.public_note | html %]
|
|
[% ELSIF (cr.item.itemnotes) %]
|
|
[% cr.item.itemnotes | html %]
|
|
[% END %]
|
|
</td>
|
|
|
|
<td>
|
|
[% IF (cr.item.uri) %]
|
|
<a href="[% cr.item.uri | html %]">Item URI</a>
|
|
[% ELSIF (cr.biblioitem.url) %]
|
|
<a href="[% cr.biblioitem.url | html %]">Record URL</a>
|
|
[% END %]
|
|
</td>
|
|
|
|
<td>
|
|
[% FOREACH c IN cr.courses %]
|
|
[% UNLESS cr.course_id == c.course_id %]
|
|
<p>
|
|
<a href="course-details.pl?course_id=[% c.course_id | html %]">
|
|
[% c.course_name | html %]
|
|
[% IF c.section %] [% c.section | html %] [% END %]
|
|
[% IF c.term %] [% AuthorisedValues.GetByCode( 'TERM', c.term ) | html %] [% END %]
|
|
</a>
|
|
</p>
|
|
[% END %]
|
|
[% END %]
|
|
</td>
|
|
|
|
[% IF CAN_user_coursereserves_add_reserves || CAN_user_coursereserves_delete_reserves %]
|
|
<td class="actions">
|
|
[% IF CAN_user_coursereserves_add_reserves %]
|
|
<a class="btn btn-default btn-xs" href="add_items.pl?course_id=[% course.course_id | html %]&itemnumber=[% cr.item.itemnumber | html %]&action=lookup&return=[% course.course_id | html %]"><i class="fa fa-pencil"></i> Edit</a>
|
|
[% END %]
|
|
|
|
[% IF CAN_user_coursereserves_delete_reserves %]
|
|
[% IF cr.item.onloan %]
|
|
<a class="btn btn-default btn-xs disabled checkedout delete_item" href="#" data-toggle="tooltip" data-placement="left" title="This item is checked out">
|
|
[% ELSE %]
|
|
<a class="btn btn-default btn-xs delete_item" href="course-details.pl?course_id=[% course.course_id | html %]&action=del_reserve&cr_id=[% cr.cr_id | html %]">
|
|
[% END %]
|
|
<i class="fa fa-trash"></i> Remove</a>
|
|
[% END %]
|
|
</td>
|
|
[% END %]
|
|
|
|
</tr>
|
|
[% END %]
|
|
</tbody>
|
|
</table>
|
|
[% END %]
|
|
</div>
|
|
</div>
|
|
|
|
[% MACRO jsinclude BLOCK %]
|
|
[% INCLUDE 'datatables.inc' %]
|
|
<script type="text/javascript">
|
|
$(document).ready(function(){
|
|
$("#course_reserves_table").dataTable($.extend(true, {}, dataTablesDefaults, {
|
|
"sPaginationType": "four_button",
|
|
"aoColumnDefs": [
|
|
{ 'bSortable': false, 'aTargets': [ 'NoSort' ] },
|
|
{ 'sType': "anti-the", 'aTargets' : [ 'antithe'] }
|
|
]
|
|
}));
|
|
|
|
$(".delete_item").click(function(){
|
|
return confirmDelete(_("Are you sure you want to remove this item from the course?"));
|
|
});
|
|
|
|
$("#delete_course").click(function(){
|
|
[% SET count = course_reserves.size || 0 %]
|
|
[% IF count == 1 %]
|
|
return confirmDelete(_("Are you sure you want to delete this course? There is %s attached item.").format([% count | html %]) );
|
|
[% ELSIF count > 1 %]
|
|
return confirmDelete(_("Are you sure you want to delete this course? There are %s attached items.").format([% count | html %]) );
|
|
[% ELSE %]
|
|
return confirmDelete(_("Are you sure you want to delete this course?"));
|
|
[% END %]
|
|
});
|
|
$(".disabled").tooltip().on("click", function(e){
|
|
e.preventDefault();
|
|
if( $(this).hasClass("checkedout") ){
|
|
alert(_("This item cannot be removed. It is checked out"));
|
|
}
|
|
});
|
|
});
|
|
</script>
|
|
[% END %]
|
|
|
|
[% INCLUDE 'intranet-bottom.inc' %]
|