Josef Moravec
b59988f78d
Test plan:
1) do not apply this patch
2) Have at least one vendor which name does contain javascript, for
example: <i>Vendor 1</i><script>alert('Hi');</script>
3) go to serial module and create new subscription
4) use "Search for vendor"
5) Search for your vendor, when search results table is presented, the
javascript is executed
6) go through subscription creation and save the new subscription
7) On subscription detail page, the javascript is executed as well
8) apply this patch
9) Repeat 3-7, the script is not executed, the input is escaped
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
62 lines
1.7 KiB
Text
62 lines
1.7 KiB
Text
[% SET footerjs = 1 %]
|
|
[% INCLUDE 'doc-head-open.inc' %]
|
|
<title>Koha › Serials › Select vendor</title>
|
|
[% INCLUDE 'doc-head-close.inc' %]
|
|
</head>
|
|
|
|
<body id="ser_acqui-search-result" class="ser">
|
|
|
|
<div id="doc" class="yui-t7">
|
|
<div id="bd">
|
|
|
|
|
|
<h1>Vendor search results</h1>
|
|
[% UNLESS count %]
|
|
<h2>Your search returned no results.</h2>
|
|
[% ELSIF ( supplier.length < 1 ) %]
|
|
<h2>Vendor search: [% count %] result(s) found</h2>
|
|
[% ELSE %]
|
|
<h2>Vendor search: [% count %] result(s) found for '[% supplier %]'</h2>
|
|
[% END %]
|
|
|
|
[% IF ( loop_suppliers ) %]
|
|
<table>
|
|
<tr>
|
|
<th>Vendor</th>
|
|
<th>Select</th>
|
|
</tr>
|
|
[% FOREACH loop_supplier IN loop_suppliers %]
|
|
<tr>
|
|
<td>[% loop_supplier.name |html %]</td>
|
|
<td><a class="btn btn-default btn-xs select_vendor" href="#" data-vendorid="[% loop_supplier.aqbooksellerid %]" data-vendorname="[% loop_supplier.name |html%]">Choose</a></td>
|
|
</tr>
|
|
[% END %]
|
|
</table>
|
|
[% END %]
|
|
|
|
<p><a href="/cgi-bin/koha/serials/acqui-search.pl">Perform a new search</a></p>
|
|
|
|
<div id="closewindow"><a href="#" class="btn btn-default btn-default close">Cancel</a></div>
|
|
|
|
</div>
|
|
|
|
[% MACRO jsinclude BLOCK %]
|
|
<script type="text/javascript">
|
|
function GetIt(aqbooksellerid,name){
|
|
opener.document.f.aqbooksellerid.value = aqbooksellerid;
|
|
opener.document.f.aqbooksellername.value = name;
|
|
window.close();
|
|
}
|
|
|
|
$(document).ready(function(){
|
|
$(".select_vendor").on("click",function(e){
|
|
e.preventDefault();
|
|
var vendorname = $(this).data("vendorname");
|
|
var vendorid = $(this).data("vendorid");
|
|
GetIt( vendorid, vendorname );
|
|
});
|
|
});
|
|
</script>
|
|
[% END %]
|
|
|
|
[% INCLUDE 'intranet-bottom.inc' %]
|