dcd1f5d48c
Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
225 lines
13 KiB
Text
225 lines
13 KiB
Text
[% USE raw %]
|
|
[% USE Koha %]
|
|
[% INCLUDE 'doc-head-open.inc' %]
|
|
<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog ›
|
|
[% IF Koha.Preference( 'opacuserlogin' ) == 1 %]
|
|
Log in to your account
|
|
[% ELSE %]
|
|
Catalog login disabled
|
|
[% END %]</title>
|
|
[% INCLUDE 'doc-head-close.inc' %]
|
|
[% BLOCK cssinclude %][% END %]
|
|
</head>
|
|
[% INCLUDE 'bodytag.inc' bodyid='opac-login-page' bodyclass='scrollto' %]
|
|
[% INCLUDE 'masthead.inc' %]
|
|
|
|
<div class="main">
|
|
<ul class="breadcrumb">
|
|
<li><a href="/cgi-bin/koha/opac-main.pl">Home</a> <span class="divider">›</span></li>
|
|
<li><a href="#">Log in</a></li>
|
|
</ul>
|
|
|
|
<div class="container-fluid">
|
|
<div class="row-fluid">
|
|
<div class="span7 offset2">
|
|
<div id="opac-auth" class="maincontent">
|
|
<!--CONTENT-->
|
|
[% IF Koha.Preference( 'opacuserlogin' ) == 1 %]
|
|
[% IF ( nopermission ) %]
|
|
<!-- This is what is displayed if user doesnt have permission -->
|
|
<div class="alert">
|
|
<h3>Access denied</h3>
|
|
<p>Sorry, the system doesn't think you have permission to access this page. </p>
|
|
[% IF SCO_login %]
|
|
<p><a href="/cgi-bin/koha/sco/sco-main.pl?logout.x=1">Log out and try again with a different user.</a></p>
|
|
[% ELSIF SCI_login %]
|
|
<p><a href="/cgi-bin/koha/sci/sci-main.pl?logout.x=1">Log out and try again with a different user.</a></p>
|
|
[% END %]
|
|
</div>
|
|
[% END %]
|
|
|
|
[% IF ( loginprompt ) %]
|
|
<!-- login prompt time-->
|
|
<h3>Log in to your account</h3>
|
|
|
|
[% IF ( timed_out ) %]
|
|
<!-- This is what is displayed if login has timed out -->
|
|
<div class="alert alert-info">
|
|
<p>Sorry, your session has timed out. Please log in again.</p>
|
|
</div>
|
|
[% END %]
|
|
|
|
[% IF ( different_ip ) %]
|
|
<!-- This is what is displayed if user doesnt have permission -->
|
|
<div class="alert alert-info">
|
|
<p>You are logging from a different IP address. Please log in again.</p>
|
|
</div>
|
|
[% END %]
|
|
|
|
|
|
[% IF too_many_login_attempts %]
|
|
<div class="alert alert-info">
|
|
This account has been locked!
|
|
[% IF Koha.Preference('OpacResetPassword') %]
|
|
<a href="/cgi-bin/koha/opac-password-recovery.pl">You must reset your password</a>.
|
|
[% ELSE %]
|
|
Please contact a library staff member.
|
|
[% END %]
|
|
</div>
|
|
[% ELSIF invalid_username_or_password %]
|
|
<!-- This is what is displayed if user doesnt have permission -->
|
|
<div class="alert alert-info">
|
|
<p>You entered an incorrect username or password. Please try again! And remember, passwords are case sensitive.</p>
|
|
</div>
|
|
[% END %]
|
|
|
|
[% IF ( shibbolethAuthentication ) %]
|
|
[% IF ( invalidShibLogin ) %]
|
|
<!-- This is what is displayed if shibboleth login has failed to match a koha user -->
|
|
<div class="alert alert-info">
|
|
<p>Sorry, your Shibboleth identity does not match a valid library identity.</p>
|
|
[% IF ( casAuthentication ) %]
|
|
[% IF ( invalidCasLogin ) %]
|
|
<!-- This is what is displayed if cas login has failed -->
|
|
<p>Sorry, the CAS login also failed. If you have a local login you may use that below.</p>
|
|
[% ELSE %]
|
|
<p>If you have a CAS account, you may use that below.</p>
|
|
[% END %]
|
|
[% ELSE %]
|
|
<p>If you have a local account, you may use that below.</p>
|
|
[% END %]
|
|
</div>
|
|
[% ELSE %]
|
|
<h4>Shibboleth Login</h4>
|
|
<p><a href="[% shibbolethLoginUrl | html %]">If you have a Shibboleth account, please click here to log in.</a></p>
|
|
[% END %]
|
|
[% IF ( casAuthentication ) %]
|
|
<h4>CAS login</h4>
|
|
<p>If you do not have a Shibboleth account, but you do have a CAS account, you can use CAS.</p>
|
|
[% ELSE %]
|
|
<h4>Local login</h4>
|
|
<p>If you do not have a Shibboleth account, but you do have a local login, then you may login below.</p>
|
|
[% END %]
|
|
|
|
[% END %]
|
|
|
|
[% IF ( casAuthentication ) %]
|
|
[% IF ( shibbolethAuthentication ) %]
|
|
[% IF ( casServerUrl ) %]
|
|
<p><a href="[% casServerUrl | html %]">Please click here to log in.</a><p>
|
|
[% END %]
|
|
|
|
[% IF ( casServersLoop ) %]
|
|
<p>Please choose against which one you would like to authenticate: </p>
|
|
<ul>
|
|
[% FOREACH casServer IN casServersLoop %]
|
|
<li><a href="[% casServer.value | html %]">[% casServer.name | html %]</a></li>
|
|
[% END %]
|
|
</ul>
|
|
[% END %]
|
|
[% ELSE %]
|
|
<h4>CAS login</h4>
|
|
|
|
[% IF ( invalidCasLogin ) %]
|
|
<!-- This is what is displayed if cas login has failed -->
|
|
<p>Sorry, the CAS login failed.</p>
|
|
[% END %]
|
|
|
|
[% IF ( casServerUrl ) %]
|
|
<p><a href="[% casServerUrl | html %]">If you have a CAS account, please click here to log in.</a><p>
|
|
[% END %]
|
|
|
|
[% IF ( casServersLoop ) %]
|
|
<p>If you have a CAS account, please choose against which one you would like to authenticate:</p>
|
|
<ul>
|
|
[% FOREACH casServer IN casServersLoop %]
|
|
<li><a href="[% casServer.value | html %]">[% casServer.name | html %]</a></li>
|
|
[% END %]
|
|
</ul>
|
|
[% END %]
|
|
[% END %]
|
|
|
|
[% IF ( shibbolethAuthentication ) %]
|
|
<p>Nothing</p>
|
|
[% ELSE %]
|
|
<h4>Local login</h4>
|
|
<p>If you do not have a CAS account, but do have a local account, you can still log in: </p>
|
|
[% END %]
|
|
|
|
[% END # / IF casAuthentication %]
|
|
|
|
[% IF ( Koha.Preference('GoogleOpenIDConnect') == 1 ) %]
|
|
[% IF ( invalidGoogleOpenIDConnectLogin ) %]
|
|
<h4>Google login</h4>
|
|
<p>Sorry, your Google login failed. <span class="error">[% invalidGoogleOpenIDConnectLogin | html %]</span></p>
|
|
<p>Please note that the Google login will only work if you are using the e-mail address registered with this library.</p>
|
|
<p>If you want to, you can try to <a href="/cgi-bin/koha/svc/auth/googleopenidconnect?reauthenticate=select_account">log in using a different account</a>
|
|
[% END %]
|
|
<a href="/cgi-bin/koha/svc/auth/googleopenidconnect" class="btn btn-primary" id="openid_connect">Log in with Google</a>
|
|
<p>If you do not have a Google account, but do have a local account, you can still log in: </p>
|
|
[% END %]
|
|
|
|
[% IF SCO_login %]
|
|
<form action="/cgi-bin/koha/sco/sco-main.pl" name="auth" id="auth" method="post" autocomplete="off">
|
|
[% ELSIF SCI_login %]
|
|
<form action="/cgi-bin/koha/sci/sci-main.pl" name="auth" id="auth" method="post" autocomplete="off">
|
|
[% ELSE %]
|
|
<form action="[% script_name | html %]" name="auth" id="auth" method="post" autocomplete="off">
|
|
[% END %]
|
|
<input type="hidden" name="koha_login_context" value="opac" />
|
|
<fieldset class="brief">
|
|
[% FOREACH INPUT IN INPUTS %]
|
|
<input type="hidden" name="[% INPUT.name | html %]" value="[% INPUT.value | html %]" />
|
|
[% END %]
|
|
<label for="userid">Login</label>
|
|
<input type="text" size="25" id="userid" name="userid" />
|
|
<label for="password">Password</label><input type="password" size="25" id="password" name="password" />
|
|
</fieldset>
|
|
|
|
<input type="submit" value="Log in" class="btn" />
|
|
[% IF Koha.Preference('OpacPasswordChange') && Koha.Preference('OpacResetPassword') %]
|
|
<div id="forgotpassword">
|
|
<a href="/cgi-bin/koha/opac-password-recovery.pl">Forgot your password?</a>
|
|
</div>
|
|
[% END %]
|
|
<div id="nologininstructions">
|
|
[% IF Koha.Preference('OpacLoginInstructions') %]
|
|
[% Koha.Preference('OpacLoginInstructions') | $raw %]
|
|
[% ELSE %]
|
|
<h5>Don't have a password yet?</h5>
|
|
<p>If you don't have a password yet, stop by the circulation desk the next time you're in the library. We'll happily set one up for you.</p>
|
|
<h5>Don't have a library card?</h5>
|
|
<p>If you don't have a library card, stop by your local library to sign up.</p>
|
|
[% END # / IF Koha.Preference('OpacLoginInstructions') %]
|
|
|
|
[% IF PatronSelfRegistration && PatronSelfRegistrationDefaultCategory %]<span id="registrationinstructions"><a href="/cgi-bin/koha/opac-memberentry.pl">You may register here.</a></span>
|
|
[% END %]
|
|
</div>
|
|
</form>
|
|
[% END # / IF loginprompt %]
|
|
|
|
[% ELSE %]
|
|
<h4>Logging on to the catalog has not been enabled by the library.</h4>
|
|
<ul>
|
|
<li>To report this error, you can email the Koha Administrator.<a href="mailto:[% admin | html %]">Email</a></li>
|
|
<li>Use top menu bar to navigate to another part of Koha.</li>
|
|
</ul>
|
|
[% END # / IF opacuserlogin %]
|
|
|
|
</div> <!-- /.opac-auth -->
|
|
</div> <!-- /.span12 -->
|
|
</div> <!-- /.row-fluid -->
|
|
</div> <!-- /.container-fluid -->
|
|
</div> <!-- /.main -->
|
|
|
|
[% INCLUDE 'opac-bottom.inc' %]
|
|
[% BLOCK jsinclude %]
|
|
<script>
|
|
//<![CDATA[
|
|
// Hide circular 'Log in to Your Account' link in opac-auth.pl
|
|
$(document).ready(function() {
|
|
if ( $("#auth" ) ) { $("#members ul li a").hide(); }
|
|
});
|
|
//]]>
|
|
</script>
|
|
[% END %]
|