dcd1f5d48c
Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
398 lines
17 KiB
Text
398 lines
17 KiB
Text
[% USE raw %]
|
|
[% USE Asset %]
|
|
[% USE Koha %]
|
|
[% USE Branches %]
|
|
[% USE AuthorisedValues %]
|
|
[% SET footerjs = 1 %]
|
|
[% INCLUDE 'doc-head-open.inc' %]
|
|
<title>Koha › Serials › Details for subscription #[% subscriptionid | html %]</title>
|
|
[% INCLUDE 'doc-head-close.inc' %]
|
|
</head>
|
|
|
|
<body id="ser_subscription-detail" class="ser">
|
|
[% INCLUDE 'header.inc' %]
|
|
[% INCLUDE 'serials-search.inc' %]
|
|
|
|
<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> › <a href="/cgi-bin/koha/serials/serials-home.pl">Serials</a> › Details for subscription #[% subscriptionid | html %]</div>
|
|
|
|
<div id="doc3" class="yui-t2">
|
|
|
|
<div id="bd">
|
|
<div id="yui-main">
|
|
<div class="yui-b">
|
|
[% INCLUDE 'serials-toolbar.inc' %]
|
|
|
|
<h1>Subscription for [% bibliotitle | html %] [% IF closed %](closed)[% END %]</h1>
|
|
[% IF ( abouttoexpire ) %]
|
|
[% UNLESS closed %]
|
|
<div class="dialog message">Subscription will expire [% enddate | html %]. <a href="#" id="renewsub">Renew this subscription</a>.</div>
|
|
[% END %]
|
|
[% END %]
|
|
[% IF ( NEEDSCONFIRMATION ) %]
|
|
<div id="circ_needsconfirmation" class="dialog alert">
|
|
<h3>Please confirm subscription deletion</h3>
|
|
|
|
<ul>
|
|
[% IF ( NOTEXPIRED ) %] <li>The subscription has not expired yet</li> [% END %]
|
|
[% IF ( LINKEDISSUES ) %] <li>The subscription has linked issues</li> [% END %]
|
|
[% IF ( LINKEDITEMS ) %] <li>The subscription has linked items<br /> Those items won't be deleted</li> [% END %]
|
|
</ul>
|
|
<form method="post" action="/cgi-bin/koha/serials/subscription-detail.pl">
|
|
<input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]" />
|
|
<input type="hidden" name="issueconfirmed" value="1" />
|
|
<input type="hidden" name="op" value="del" />
|
|
<button type="submit" class="approve" accesskey="y"><i class="fa fa-fw fa-check"></i> Yes, delete (Y)</button>
|
|
</form>
|
|
<form method="get" action="/cgi-bin/koha/serials/subscription-detail.pl">
|
|
<input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]" />
|
|
<button type="submit" class="deny" accesskey="n"><i class="fa fa-fw fa-remove"></i> No, don't delete (N)</button>
|
|
</form>
|
|
|
|
</div>
|
|
[% END %] <!-- NEEDSCONFIRMATION -->
|
|
|
|
<div id="subscription_description" class="toptabs">
|
|
<ul class="ui-tabs-nav">
|
|
<li><a href="#subscription_info">Information</a></li>
|
|
<li><a href="#subscription_planning">Planning</a></li>
|
|
<li><a href="#subscription_issues">Issues</a></li>
|
|
<li><a href="#subscription_summary">Summary</a></li>
|
|
</ul>
|
|
|
|
<div id="subscription_info">
|
|
<div class="yui-g">
|
|
<div class="yui-u first">
|
|
<div class="rows">
|
|
<ol>
|
|
<li><span class="label">Subscription ID: </span>[% subscriptionid | html %]</li>
|
|
<li><span class="label">Librarian identity:</span> [% librarian | html %]</li>
|
|
<li><span class="label">Vendor:</span> <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% aqbooksellerid | html %]">[% aqbooksellername | html %]</a></li>
|
|
<li><span class="label">Biblio:</span> <a href="/cgi-bin/koha/catalogue/[% default_bib_view | html %].pl?biblionumber=[% bibnum | html %]">[% bibliotitle | html %]</a> <i>([% bibnum | html %])</i></li>
|
|
[% IF ( OPACBaseURL ) %]
|
|
<li>
|
|
<span class="label">OPAC view:</span>
|
|
<a id="view-subscription-in-opac" target="_blank" href="[% Koha.Preference('OPACBaseURL') | html %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber | html %]">Open in new window.</a>
|
|
</li>
|
|
[% END %]
|
|
[% IF ( branchcode ) %]<li><span class="label">Library:</span> [% Branches.GetName( branchcode ) | html %]</li>[% END %]
|
|
[% IF ( serialsadditems ) %]
|
|
<li><span class="label">Items:</span> Serial receipt creates an item record.</li>
|
|
[% ELSE %]
|
|
<li><span class="label">Items:</span> Serial receipt does not create an item record.</li>
|
|
[% END %]
|
|
<li>
|
|
<span class="label">Serial number:</span>
|
|
[% IF skip_serialseq %]
|
|
Serial number is skipped when an irregularity is found.
|
|
[% ELSE %]
|
|
Serial number is kept when an irregularity is found.
|
|
[% END %]
|
|
</li>
|
|
<li><span class="label">Grace period:</span> [% graceperiod | html %]</li>
|
|
</ol>
|
|
</div>
|
|
</div>
|
|
<div class="yui-u">
|
|
<div class="rows">
|
|
<ol>
|
|
[% IF ( location ) %]<li><span class="label">Location:</span> [% location | html %]</li>[% END %]
|
|
[% IF ( callnumber ) %]<li><span class="label">Call number:</span> [% callnumber | html %]</li>[% END %]
|
|
[% IF ( staffdisplaycount ) %]<li><span class="label">Number of issues to display to staff:</span>[% staffdisplaycount | html %]</li>[% END %]
|
|
[% IF ( opacdisplaycount ) %]<li><span class="label">Number of issues to display in OPAC:</span>[% opacdisplaycount | html %]</li>[% END %]
|
|
[% IF ( letter ) %]
|
|
<li>
|
|
<span class="label">Patron notification:</span> [% letter | html %]
|
|
(<a href="/cgi-bin/koha/serials/viewalerts.pl?subscriptionid=[% subscriptionid | html %]">subscribers</a>)
|
|
</li>
|
|
[% END %]
|
|
[% IF ( hasRouting ) %]<li><span class="label">Routing:</span> yes</li>[% END %]
|
|
</ol>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
[% IF additional_fields_for_subscription %]
|
|
<div class="yui-g">
|
|
<div class="yui-u first">
|
|
<div class="rows">
|
|
<legend>Additional fields:</legend>
|
|
<ol>
|
|
[% FOR field IN additional_fields_for_subscription %]
|
|
<li>
|
|
<span class="label">[% field.name | html %]:</span>
|
|
[% IF field.authorised_value_category %]
|
|
[% AuthorisedValues.GetByCode( field.authorised_value_category, additional_fields.${field.name} ) | html %]
|
|
[% ELSE %]
|
|
[% additional_fields.${field.name} | html %]
|
|
[% END %]
|
|
</li>
|
|
[% END %]
|
|
</ol>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
[% END %]
|
|
</div>
|
|
|
|
<div id="subscription_planning">
|
|
<div class="yui-g">
|
|
<div class="rows">
|
|
<ol>
|
|
<li><span class="label">Beginning date:</span> [% startdate | html %]
|
|
</li>
|
|
<li><span class="label">Frequency:</span>
|
|
[% frequency.description | html %]
|
|
</li>
|
|
<li>
|
|
<span class="label">Manual history: </span>
|
|
[% IF ( manualhistory ) %]
|
|
Enabled <a href="/cgi-bin/koha/serials/subscription-history.pl?subscriptionid=[% subscriptionid | html %]">Edit history</a>
|
|
[% ELSE %]
|
|
Disabled
|
|
[% END %]
|
|
</li>
|
|
<li><span class="label">Number pattern:</span>
|
|
[% numberpattern.label | html %]
|
|
</li>
|
|
<li><table>
|
|
<tr>
|
|
<td>Starting with:</td>
|
|
[% IF (has_X) %]
|
|
<td align="center">[% lastvalue1 | html %]</td>
|
|
[% END %]
|
|
[% IF (has_Y) %]
|
|
<td align="center">[% lastvalue2 | html %]</td>
|
|
[% END %]
|
|
[% IF (has_Z) %]
|
|
<td align="center">[% lastvalue3 | html %]</td>
|
|
[% END %]
|
|
</tr>
|
|
<tr>
|
|
<td>Rollover:</td>
|
|
[% IF (has_X) %]
|
|
<td align="center">[% numberpattern.whenmorethan1 | html %]</td>
|
|
[% END %]
|
|
[% IF (has_Y) %]
|
|
<td align="center">[% numberpattern.whenmorethan2 | html %]</td>
|
|
[% END %]
|
|
[% IF (has_Z) %]
|
|
<td align="center">[% numberpattern.whenmorethan3 | html %]</td>
|
|
[% END %]
|
|
</tr>
|
|
</table></li>
|
|
[% IF ( irregular_issues ) %]
|
|
<li><span class="label">Irregularity:</span> [% irregular_issues | html %] issues
|
|
</li>
|
|
[% END %]
|
|
<li><span class="label">First arrival:</span> [% firstacquidate | html %]
|
|
</li>
|
|
[% IF ( numberlength ) %]<li><span class="label">Number of issues:</span> [% numberlength | html %]</li>[% END %]
|
|
[% IF ( weeklength ) %]<li><span class="label">Number of weeks:</span> [% weeklength | html %]</li>[% END %]
|
|
[% IF ( monthlength ) %]<li><span class="label">Number of months:</span> [% monthlength | html %]</li>[% END %]
|
|
</ol>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div id="subscription_numbering" style="display:none;">
|
|
<h3>Numbering calculation</h3>
|
|
<p><label>Numbering formula:</label> [% numberingmethod | html %]</p>
|
|
<table>
|
|
<tr>
|
|
<th> </th>
|
|
<th>X</th>
|
|
<th>Y</th>
|
|
<th>Z</th>
|
|
</tr>
|
|
<tr>
|
|
<td>Add</td>
|
|
<td>
|
|
[% add1 | html %]
|
|
</td>
|
|
<td>
|
|
[% add2 | html %]
|
|
</td>
|
|
<td>
|
|
[% add3 | html %]
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>once every</td>
|
|
<td>[% every1 | html %]</td>
|
|
<td>[% every2 | html %]</td>
|
|
<td>[% every3 | html %]</td>
|
|
</tr>
|
|
<tr>
|
|
<td>When more than</td>
|
|
<td>[% whenmorethan1 | html %] [% IF ( innerloop1 ) %]<br />
|
|
<i>(is [% innerloop1 | html %])</i>[% END %]</td>
|
|
<td>[% whenmorethan2 | html %] [% IF ( innerloop2 ) %]<br />
|
|
<i>(is [% innerloop2 | html %])</i>[% END %]</td>
|
|
<td>[% whenmorethan3 | html %] [% IF ( innerloop3 ) %]<br />
|
|
<i>(is [% innerloop3 | html %])</i>[% END %]</td>
|
|
</tr>
|
|
<tr>
|
|
<td>Set back to</td>
|
|
<td>[% setto1 | html %]</td>
|
|
<td>[% setto2 | html %]</td>
|
|
<td>[% setto3 | html %]</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
Inner counter
|
|
</td>
|
|
<td>[% innerloop1 | html %]</td>
|
|
<td>[% innerloop2 | html %]</td>
|
|
<td>[% innerloop3 | html %]</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
Last value
|
|
</td>
|
|
<td>[% lastvalue1 | html %]</td>
|
|
<td>[% lastvalue2 | html %]</td>
|
|
<td>[% lastvalue3 | html %]</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
<div id="subscription_issues">
|
|
<table>
|
|
<tr>
|
|
<th>Issue number</th>
|
|
<th>Planned date</th>
|
|
<th>Published date</th>
|
|
<th>Published date (text)</th>
|
|
<th>Status</th>
|
|
</tr>
|
|
[% FOREACH serialslis IN serialslist %]
|
|
<tr>
|
|
<td>
|
|
[% serialslis.serialseq | html %]
|
|
</td>
|
|
<td>
|
|
[% IF serialslis.planneddate %]
|
|
[% serialslis.planneddate | html %]
|
|
[% ELSE %]
|
|
Unknown
|
|
[% END %]
|
|
</td>
|
|
<td>
|
|
[% IF serialslis.publisheddate %]
|
|
[% serialslis.publisheddate | html %]
|
|
[% ELSE %]
|
|
Unknown
|
|
[% END %]
|
|
</td>
|
|
<td>
|
|
[% serialslis.publisheddatetext | html %]
|
|
</td>
|
|
<td>
|
|
[% IF ( serialslis.status1 ) %]Expected[% END %]
|
|
[% IF ( serialslis.status2 ) %]Arrived[% END %]
|
|
[% IF ( serialslis.status3 ) %]Late[% END %]
|
|
[% IF ( serialslis.status4 ) %]Missing[% END %]
|
|
[% IF ( serialslis.status41 ) %]Missing (never received)[% END %]
|
|
[% IF ( serialslis.status42 ) %]Missing (sold out)[% END %]
|
|
[% IF ( serialslis.status43 ) %]Missing (damaged)[% END %]
|
|
[% IF ( serialslis.status44 ) %]Missing (lost)[% END %]
|
|
[% IF ( serialslis.status5 ) %]Not issued[% END %]
|
|
[% IF ( serialslis.status6 ) %]Delete[% END %]
|
|
[% IF ( serialslis.status7 ) %]
|
|
Claimed
|
|
[% IF ( serialslis.claimdate ) %]
|
|
[% serialslis.claimdate | html %]
|
|
[% END %]
|
|
[% END %]
|
|
[% IF ( serialslis.status8 ) %]Stopped[% END %]
|
|
</td>
|
|
</tr>
|
|
[% END %]
|
|
</table>
|
|
</div>
|
|
<div id="subscription_summary">
|
|
<div class="yui-g">
|
|
<div class="rows">
|
|
<ol>
|
|
<li><span class="label">Start date:</span> [% startdate | html %] </li>
|
|
<li><span class="label">End date:</span> [% enddate | html %]</li>
|
|
<li><span class="label">History start date:</span> [% histstartdate | html %] </li>
|
|
<li><span class="label">History end date:</span> [% histenddate | html %]</li>
|
|
<li><span class="label">Received issues:</span>[% recievedlist | html %]</li>
|
|
<li><span class="label">Missing issues:</span>[% missinglist | html %]</li>
|
|
<li><span class="label">Nonpublic note:</span>[% internalnotes FILTER html_line_break | html %]</li>
|
|
<li><span class="label">Public note:</span>[% notes FILTER html_line_break | html %]</li>
|
|
<li><span class="label">History staff note:</span>[% librariannote FILTER html_line_break | html %]</li>
|
|
<li><span class="label">History OPAC note:</span>[% opacnote FILTER html_line_break | html %]</li>
|
|
</ol>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
[% IF ( show_acquisition_details ) %]
|
|
<div id="acquisition_details">
|
|
<h2>Acquisition details</h2>
|
|
<table>
|
|
<thead>
|
|
<tr><th></th><th>Price exc. taxes</th><th>Price inc. taxes</th><th>Fund</th><th></th></tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>Ordered amount</td>
|
|
<td>[% value_tax_excluded_ordered | html %]</td>
|
|
<td>[% value_tax_included_ordered | html %]</td>
|
|
<td>[% budget_name_ordered | html %]</td>
|
|
<td>
|
|
[% IF ( ordered_exists ) %]
|
|
<a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno | html %]">See basket information</a>
|
|
[% END %]
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>Spent amount</td>
|
|
<td>[% value_tax_excluded_spent | html %]</td>
|
|
<td>[% value_tax_included_spent | html %]</td>
|
|
<td>[% budget_name_spent | html %]</td>
|
|
<td>
|
|
[% IF ( spent_exists ) %]
|
|
<a href="/cgi-bin/koha/acqui/invoice.pl?invoiceid=[% invoiceid | html %]">See invoice information</a>
|
|
[% END %]
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
[% END %]
|
|
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div class="yui-b">
|
|
[% INCLUDE 'serials-menu.inc' %]
|
|
</div>
|
|
</div>
|
|
|
|
[% MACRO jsinclude BLOCK %]
|
|
<script type="text/javascript">
|
|
var subscriptionid = "[% subscriptionid | html %]";
|
|
var MSG_CLOSE_SUBSCRIPTION = _("Are you sure you want to close this subscription?");
|
|
var MSG_REOPEN_SUBSCRIPTION = _("Are you sure you want to reopen this subscription?");
|
|
var CONFIRM_DELETE_SUBSCRIPTION = _("Are you sure you want to delete this subscription?");
|
|
</script>
|
|
[% Asset.js("js/serials-toolbar.js") | $raw %]
|
|
<script type="text/javascript">
|
|
// the english words used in display purposes
|
|
var text = new Array(_("Number"),_("Volume"),_("Issue"),_("Month"),_("Week"),_("Starting with:"),_("Rollover at:"),_("Choose Hemisphere:"),_("Northern"),_("Southern",
|
|
"Autumn"),_("Winter"),_("Spring"),_("Summer"),_("Fall"),_("Season"),_("Year"));
|
|
$(document).ready(function() {
|
|
$("#subscription_description").tabs();
|
|
$("#renewsub").click(function(){
|
|
popup([% subscriptionid | html %]);
|
|
return false;
|
|
})
|
|
});
|
|
</script>
|
|
[% END %]
|
|
|
|
[% INCLUDE 'intranet-bottom.inc' %]
|