dcd1f5d48c
Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
200 lines
12 KiB
Text
200 lines
12 KiB
Text
[% USE raw %]
|
|
[% USE Asset %]
|
|
[% USE AuthorisedValues %]
|
|
[% USE Branches %]
|
|
[% USE Categories %]
|
|
[% USE KohaDates %]
|
|
[% SET footerjs = 1 %]
|
|
[% INCLUDE 'doc-head-open.inc' %]
|
|
<title>Koha › Patrons › Update patron records</title>
|
|
[% INCLUDE 'doc-head-close.inc' %]
|
|
</head>
|
|
|
|
<body id="pat_update" class="pat">
|
|
[% INCLUDE 'header.inc' %]
|
|
[% INCLUDE 'patron-search.inc' %]
|
|
|
|
[% BLOCK display_names %]
|
|
[% SWITCH field %]
|
|
[% CASE 'branchcode' %]<span>Home library (branchcode)</span>
|
|
[% CASE 'surname' %]<span>Surname</span>
|
|
[% CASE 'firstname' %]<span>First name</span>
|
|
[% CASE 'title' %]<span>Title</span>
|
|
[% CASE 'othernames' %]<span>Other names</span>
|
|
[% CASE 'initials' %]<span>Initials</span>
|
|
[% CASE 'streetnumber' %]<span>Street number</span>
|
|
[% CASE 'streettype' %]<span>Street type</span>
|
|
[% CASE 'address' %]<span>Address</span>
|
|
[% CASE 'address2' %]<span>Address 2</span>
|
|
[% CASE 'city' %]<span>City</span>
|
|
[% CASE 'state' %]<span>State</span>
|
|
[% CASE 'zipcode' %]<span>ZIP/Postal code</span>
|
|
[% CASE 'country' %]<span>Country</span>
|
|
[% CASE 'email' %]<span>Email</span>
|
|
[% CASE 'phone' %]<span>Primary phone</span>
|
|
[% CASE 'mobile' %]<span>Other phone</span>
|
|
[% CASE 'fax' %]<span>Fax</span>
|
|
[% CASE 'emailpro' %]<span>Secondary email</span>
|
|
[% CASE 'phonepro' %]<span>Secondary phone</span>
|
|
[% CASE 'B_streetnumber' %]<span>Alternate address: Street number</span>
|
|
[% CASE 'B_streettype' %]<span>Alternate address: Street type</span>
|
|
[% CASE 'B_address' %]<span>Alternate address: Address</span>
|
|
[% CASE 'B_address2' %]<span>Alternate address: Address 2</span>
|
|
[% CASE 'B_city' %]<span>Alternate address: City</span>
|
|
[% CASE 'B_state' %]<span>Alternate address: State</span>
|
|
[% CASE 'B_zipcode' %]<span>Alternate address: ZIP/Postal code</span>
|
|
[% CASE 'B_email' %]<span>Alternate address: Email</span>
|
|
[% CASE 'B_phone' %]<span>Alternate address: Phone</span>
|
|
[% CASE 'contactnote' %]<span>Alternate address: Contact note</span>
|
|
[% CASE 'dateofbirth' %]<span>Date of birth</span>
|
|
[% CASE 'contactname' %]<span>Contact: Last name</span>
|
|
[% CASE 'contactfirstname' %]<span>Contact: First name</span>
|
|
[% CASE 'contacttitle' %]<span>Contact: Title</span>
|
|
[% CASE 'relationship' %]<span>Contact: Relationship</span>
|
|
[% CASE 'sex' %]<span>Gender</span>
|
|
[% CASE 'altcontactfirstname' %]<span>Alternate contact: First name</span>
|
|
[% CASE 'altcontactsurname' %]<span>Alternate contact: Surname</span>
|
|
[% CASE 'altcontactaddress1' %]<span>Alternate contact: Address</span>
|
|
[% CASE 'altcontactaddress2' %]<span>Alternate contact: Address 2</span>
|
|
[% CASE 'altcontactaddress3' %]<span>Alternate contact: City</span>
|
|
[% CASE 'altcontactstate' %]<span>Alternate contact: State</span>
|
|
[% CASE 'altcontactzipcode' %]<span>Alternate contact: ZIP/Postal code</span>
|
|
[% CASE 'altcontactcountry' %]<span>Alternate contact: Country</span>
|
|
[% CASE 'altcontactphone' %]<span>Alternate contact: Phone</span>
|
|
[% CASE 'smsalertnumber' %]<span>SMS alert number</span>
|
|
[% CASE 'extended_attributes' %]<span>Additional attributes and identifiers</span>
|
|
[% CASE %][% field | html %]
|
|
[% END %]
|
|
[% END %]
|
|
|
|
[% BLOCK display_extended_attributes %]
|
|
[% IF attrs and attrs.size > 1 %]
|
|
<ul>
|
|
[% FOREACH attr IN attrs %]
|
|
<li>[% PROCESS display_attribute attr=attr type=type %]</li>
|
|
[% END %]
|
|
<ul>
|
|
[% ELSIF attrs %]
|
|
[% PROCESS display_attribute attr=attrs.0 type=type %]
|
|
[% END %]
|
|
[% END %]
|
|
|
|
[% BLOCK display_attribute %]
|
|
[% IF type.authorised_value_category %]
|
|
[% AuthorisedValues.GetByCode(type.authorised_value_category,attr.attribute) | html %]
|
|
[% ELSE %]
|
|
[% attr.attribute | html %]
|
|
[% END %]
|
|
[% END %]
|
|
|
|
<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> › <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a> › Update patron records</div>
|
|
|
|
<div class="main container-fluid">
|
|
<div class="row">
|
|
<div class="col-md-8 col-md-offset-2">
|
|
|
|
[% IF PendingModifications %]
|
|
<h2>Update patron records</h2>
|
|
<form method="post" action="members-update-do.pl">
|
|
<div id="pending_updates">
|
|
[% FOREACH pm IN PendingModifications %]
|
|
[% SET borrowernumber = pm.borrowernumber %]
|
|
<h3><a href="#panel_modify_[% pm.borrowernumber | html %]">[% borrowers.$borrowernumber.surname | html %][% IF ( borrowers.$borrowernumber.firstname ) %], [% borrowers.$borrowernumber.firstname | html %][% END %] - [% Categories.GetName( borrowers.$borrowernumber.categorycode ) | html %] ([% Branches.GetName( borrowers.$borrowernumber.branchcode ) | html %]) ([% borrowers.$borrowernumber.cardnumber | html %]) - Requested on [% pm.timestamp | $KohaDates with_hours = 1 | html %]</a></h3>
|
|
<div id="panel_modify_[% pm.borrowernumber | html %]">
|
|
<div style="background-color:#E6F0F2;padding:.5em;margin:.3em 0;">
|
|
<input type="radio" id="approve_modify_[% pm.borrowernumber | html %]" name="modify_[% pm.borrowernumber | html %]" value="approve" />
|
|
<label for="approve_modify_[% pm.borrowernumber | html %]">Approve</label>
|
|
|
|
<input type="radio" id="deny_modify_[% pm.borrowernumber | html %]" name="modify_[% pm.borrowernumber | html %]" value="deny" />
|
|
<label for="deny_modify_[% pm.borrowernumber | html %]">Deny</label>
|
|
|
|
<input type="radio" id="ignore_modify_[% pm.borrowernumber | html %]" name="modify_[% pm.borrowernumber | html %]" value="ignore" checked="checked"/>
|
|
<label for="ignore_modify_[% pm.borrowernumber | html %]">Ignore</label>
|
|
| <a target="_blank" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% pm.borrowernumber | html %]" >Patron details</a>
|
|
</div>
|
|
[% IF !pm.extended_attributes and pm.size > 3 or pm.extended_attributes and pm.size > 4 %]
|
|
[%# timestamp+verification_token+borrowernumber=3 %]
|
|
<div class="members-update-table">
|
|
<table>
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Old value</th>
|
|
<th>New value</th>
|
|
</tr>
|
|
|
|
|
|
[% FOREACH key IN pm.keys %]
|
|
[% IF ( key != "timestamp" and key != "extended_attributes" ) %]
|
|
[% IF ( ( pm.$key OR borrowers.$borrowernumber.$key ) && ( pm.$key != borrowers.$borrowernumber.$key ) ) %]
|
|
<tr>
|
|
<td>[% PROCESS display_names field = key %]</td>
|
|
[% IF ( key == "dateofbirth" ) %]
|
|
<td>[% borrowers.$borrowernumber.$key | $KohaDates %]</td>
|
|
<td>[% pm.$key | $KohaDates %]</td>
|
|
[% ELSIF key == 'branchcode' %]
|
|
<td>[% Branches.GetName( borrowers.$borrowernumber.$key ) | html %]</td>
|
|
<td>[% Branches.GetName( pm.$key ) | html %]</td>
|
|
[% ELSE %]
|
|
<td>[% borrowers.$borrowernumber.$key | html %]</td>
|
|
<td>[% pm.$key | html %]</td>
|
|
[% END %]
|
|
</tr>
|
|
[% END %]
|
|
[% END %]
|
|
[% END %]
|
|
</table>
|
|
</div>
|
|
[% END %]
|
|
[% IF borrowers.$borrowernumber.modified_attributes %]
|
|
<div class="members-update-table">
|
|
<h4>[% PROCESS display_names field='extended_attributes' %]</h4>
|
|
<table>
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Old value</th>
|
|
<th>New value</th>
|
|
</tr>
|
|
[% FOREACH attribute_group IN borrowers.$borrowernumber.modified_attributes %]
|
|
<tr>
|
|
<td>[% attribute_group.type.description | html %]</td>
|
|
<td>[% PROCESS display_extended_attributes attrs=attribute_group.before type=attribute_group.type %]</td>
|
|
<td>[% PROCESS display_extended_attributes attrs=attribute_group.after type=attribute_group.type %]</td>
|
|
</tr>
|
|
[% END %]
|
|
</table>
|
|
</div>
|
|
[% END %]
|
|
[% IF borrowers.$borrowernumber.gonenoaddress > 0 %]
|
|
<div class="dialog message" style="margin-top:.8em">
|
|
<h4>Patron's address in doubt</h4>
|
|
<p>The <strong>Gone no address</strong> flag is set for this patron. If this modification request resolves the issue, please unset the flag.</p>
|
|
<input type="checkbox" id="unset_gna_[% pm.borrowernumber | html %]" name="unset_gna_[% pm.borrowernumber | html %]" value="unset_gna_[% pm.borrowernumber | html %]"/>
|
|
<label for="unset_gna_[% pm.borrowernumber | html %]">Unset Gone no address for this patron</label>
|
|
</div>
|
|
[% END %]
|
|
</div>
|
|
[% END %]
|
|
</div>
|
|
<fieldset class="action"><input type="submit" value="Submit" /></fieldset>
|
|
|
|
</form>
|
|
[% ELSE %]
|
|
<div class="dialog message">
|
|
<p>There are no pending patron modifications.</p>
|
|
</div>
|
|
[% END %]
|
|
|
|
</div>
|
|
</div>
|
|
|
|
[% MACRO jsinclude BLOCK %]
|
|
[% INCLUDE 'str/members-menu.inc' %]
|
|
[% Asset.js("js/members-menu.js") | $raw %]
|
|
<script type="text/javascript">
|
|
$(function() {
|
|
$( "#pending_updates" ).accordion();
|
|
});
|
|
</script>
|
|
[% END %]
|
|
|
|
[% INCLUDE 'intranet-bottom.inc' %]
|