dcd1f5d48c
Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
286 lines
15 KiB
Text
286 lines
15 KiB
Text
[% USE Koha %]
|
|
[% USE KohaDates %]
|
|
[% USE Branches %]
|
|
[% INCLUDE 'doc-head-open.inc' %]
|
|
<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog › Full subscription history for [% bibliotitle | html %]</title>
|
|
[% INCLUDE 'doc-head-close.inc' %]
|
|
[% BLOCK cssinclude %]
|
|
<style>
|
|
#search-facets fieldset { border: 0; margin: 0;padding:0;}#search-facets ol{padding:.3em;}#search-facets li {list-style-type:none;padding:4px 4px;}#search-facets label{font-weight:bold;display:block;margin:.2em 0;}#search-facets fieldset.action {padding-left:4px;margin:.3em;}div.tabsub { clear:both;}#subtabs a { display:block;float:left;border:1px solid #CCC;padding:.2em .4em;margin:.3em;text-decoration:none;font-size:115%;}#subtabs strong { display:block; float: left; font-size:115%;padding:.2em .4em; margin: 0.3em 0;}#subtabs { margin-top : 1em; }a.currentsubtab { background-color:#FFC;}
|
|
</style>
|
|
[% END %]
|
|
</head>
|
|
[% INCLUDE 'bodytag.inc' bodyid='opac-full-serial-issues' bodyclass='scrollto' %]
|
|
[% INCLUDE 'masthead.inc' %]
|
|
|
|
<div class="main">
|
|
<ul class="breadcrumb">
|
|
<li><a href="/cgi-bin/koha/opac-main.pl">Home</a> <span class="divider">›</span></li>
|
|
<li><a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber | html %]">Details for [% bibliotitle | html %]</a> <span class="divider">›</span></li>
|
|
<li><a href="#">Full subscription history</a></li>
|
|
</ul>
|
|
|
|
<div class="container-fluid">
|
|
<div class="row-fluid">
|
|
<div class="span2">
|
|
<div id="searchfacetscontainer">
|
|
<div id="search-facets">
|
|
<h4>Refine your search</h4>
|
|
<form action="/cgi-bin/koha/opac-serial-issues.pl" id="filterform">
|
|
<fieldset>
|
|
<label for="libraryfilter">Library: </label>
|
|
<select id="libraryfilter" name="libraryfilter" style="width:10em;"></select>
|
|
<label for="subscriptionidfilter">Subscription: </label>
|
|
<select id="subscriptionidfilter" name="subscriptionfilter" style="width:10em;" disabled="disabled"></select>
|
|
</fieldset>
|
|
<fieldset class="action">
|
|
<input type="reset" id="reset" class="btn" value="Clear" />
|
|
</fieldset>
|
|
</form>
|
|
</div> <!-- / #search-facets -->
|
|
</div> <!-- / #searchfacetscontainer -->
|
|
<div id="navigation">
|
|
[% INCLUDE 'navigation.inc' %]
|
|
</div>
|
|
</div> <!-- / .span2 -->
|
|
<div class="span10">
|
|
<div id="fullserialissues" class="maincontent">
|
|
[% UNLESS ( popup ) %]
|
|
<h2>Full subscription history for [% bibliotitle | html %]</h2>
|
|
<div id="views">
|
|
<span class="view"><a id="Normalview" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber | html %]">Normal view</a></span>
|
|
<span class="view"><a id="Briefhistory" href="/cgi-bin/koha/opac-serial-issues.pl?biblionumber=[% biblionumber | html %]&selectview=small">Brief history</a></span>
|
|
<span class="view"><span id="Fullhistory">Full history</span></span>
|
|
</div>
|
|
[% END %]
|
|
|
|
<div id="subtabs">
|
|
<strong>Show year: </strong>
|
|
[% FOREACH year IN years %]
|
|
[% IF ( year.year ) %]
|
|
<a class="tabsubs" href="#" onclick="showlayer([% year.year | html %]); return false;">[% year.year | html %]</a>
|
|
[% END %]
|
|
[% END %]
|
|
</div>
|
|
|
|
[% FOREACH year IN years %]
|
|
[% IF loop.first %]
|
|
<div class="yeardata tabsub" id="show[% year.year | html %]" style="display:block">
|
|
[% ELSE %]
|
|
<div class="yeardata tabsub" id="show[% year.year | html %]" style="display:none">
|
|
[% END %]
|
|
<table class="subscriptionstclass table table-bordered table-striped">
|
|
<thead>
|
|
<tr>
|
|
<th>Date</th>
|
|
<th>Library</th>
|
|
<th>Notes</th>
|
|
<th>Date received</th>
|
|
<th>Number</th>
|
|
<th>Status</th>
|
|
<th>Subscription</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
[% FOREACH serial IN year.serials %]
|
|
<tr>
|
|
<td>
|
|
[% IF ( serial.publisheddate ) %]
|
|
<span title="[% serial.publisheddate | html %]">
|
|
[% IF serial.publisheddatetext %]
|
|
[% serial.publisheddatetext | html %]
|
|
[% ELSE %]
|
|
[% serial.publisheddate | $KohaDates %]
|
|
[% END %]
|
|
</span>
|
|
[% ELSE %]
|
|
|
|
[% END %]
|
|
</td>
|
|
<td class="libraryfilterclass">[% Branches.GetName( serial.branchcode ) | html %]</td>
|
|
<td>[% serial.notes | html %]</td>
|
|
<td>
|
|
[% IF ( serial.status2 && serial.planneddate ) %]
|
|
<span title="[% serial.planneddate | html %]">[% serial.planneddate | $KohaDates %]</span>
|
|
[% ELSE %]
|
|
<span title="9999-12-31"> </span>
|
|
[% END %]
|
|
</td>
|
|
<td>[% serial.serialseq | html %]</td>
|
|
<td>
|
|
[% IF ( serial.status1 ) %]Expected[% END %]
|
|
[% IF ( serial.status2 ) %]Arrived[% END %]
|
|
[% IF ( serial.status3 ) %]Late[% END %]
|
|
[% IF ( serial.status4 ) %]Missing[% END %]
|
|
[% IF ( serial.status41 ) %]Missing (never received)[% END %]
|
|
[% IF ( serial.status42 ) %]Missing (sold out)[% END %]
|
|
[% IF ( serial.status43 ) %]Missing (damaged)[% END %]
|
|
[% IF ( serial.status44 ) %]Missing (lost)[% END %]
|
|
[% IF ( serial.status5 ) %]Not available[% END %]
|
|
[% IF ( serial.status6 ) %]Delete[% END %]
|
|
[% IF ( serial.status7 ) %]Claimed[% END %]
|
|
[% IF ( serial.status8 ) %]Stopped[% END %]
|
|
</td>
|
|
<td class="subscriptionidfilterclass">[% serial.subscriptionid | html %]</td>
|
|
</tr>
|
|
[% END %]
|
|
</tbody>
|
|
</table>
|
|
</div> <!-- / .yeardata tabsub -->
|
|
[% END # / FOREACH year %]
|
|
</div> <!-- / #fullserialissues -->
|
|
</div> <!-- / .span10 -->
|
|
</div> <!-- / .row-fluid -->
|
|
</div> <!-- / .container-fluid -->
|
|
</div> <!-- / .main -->
|
|
|
|
[% INCLUDE 'opac-bottom.inc' %]
|
|
[% BLOCK jsinclude %]
|
|
[% INCLUDE 'datatables.inc' %]
|
|
<script>
|
|
//<![CDATA[
|
|
$(document).ready(function(){
|
|
showlayer([% yearmin | html %]);
|
|
$("a.tabsubs:first").addClass("currentsubtab");
|
|
$("#filterform").submit(function(){
|
|
filterByLibrary();
|
|
return false;
|
|
});
|
|
$("#libraryfilter").change(function(){
|
|
filterByLibrary();
|
|
});
|
|
$("#subscriptionidfilter").change(function(){
|
|
filterBySubscriptionId();
|
|
});
|
|
$("#reset").click(function(){
|
|
clearFilters();
|
|
});
|
|
$("a.tabsubs").click(function(){
|
|
$("a.tabsubs").removeClass("currentsubtab");
|
|
$(this).addClass("currentsubtab");
|
|
});
|
|
$(".subscriptionstclass").dataTable($.extend(true, {}, dataTablesDefaults, {
|
|
"order": [[ 0, "desc" ]],
|
|
"columns": [
|
|
{ "type": "title-string" },
|
|
null,
|
|
null,
|
|
{ "type": "title-string" },
|
|
null,
|
|
null,
|
|
null
|
|
]
|
|
}));
|
|
});
|
|
|
|
// Filters initialization
|
|
function initFilters() {
|
|
// Deleting everything from the library filter
|
|
$("#libraryfilter option").remove();
|
|
|
|
// Getting each branchcode from the currently displayed tab
|
|
var subarray = [];
|
|
$("div#" + currentYear + " table.subscriptionstclass tbody tr:visible td.libraryfilterclass").each(function() {
|
|
if (subarray.indexOf($(this).text()) == -1) { subarray.push($(this).text()); }
|
|
});
|
|
|
|
// Setting the option values with branchcodes
|
|
$("#libraryfilter").append('<option value="all">'+_("(All)")+'</option>');
|
|
for (var i = 0; i < subarray.length; i++) {
|
|
$("#libraryfilter").append('<option value="' + subarray[i] + '">' + subarray[i] + '</option>');
|
|
}
|
|
}
|
|
|
|
// Filter by Library
|
|
|
|
function filterByLibrary() {
|
|
|
|
selectedStatus = $("#libraryfilter").val();
|
|
|
|
// Reset the filters but keeps the selected library
|
|
clearFilters(true);
|
|
|
|
if (selectedStatus != 'all') {
|
|
|
|
// We hide everything
|
|
$("table.subscriptionstclass tbody tr").hide();
|
|
|
|
// Then show the lines that match the currently selected library
|
|
$("table.subscriptionstclass tbody tr td.libraryfilterclass:contains(" + selectedStatus + ")").parent().show();
|
|
|
|
|
|
// We then prepare the subscription filter :
|
|
|
|
// Getting subscription id's for the selected library
|
|
var subarray = [];
|
|
$("div#" + currentYear + " table.subscriptionstclass tbody tr:visible td.subscriptionidfilterclass").each(function() {
|
|
if (subarray.indexOf($(this).text()) == -1) { subarray.push($(this).text()); }
|
|
});
|
|
// Setting the option values with subscription id's
|
|
$("#subscriptionidfilter").append('<option value="all">'+_("(All)")+'</option>');
|
|
for (var i = 0; i < subarray.length; i++) {
|
|
$("#subscriptionidfilter").append('<option value="' + subarray[i] + '">' + subarray[i] + '</option>');
|
|
}
|
|
|
|
// Subscription filtering is now ready
|
|
$("#subscriptionidfilter").removeAttr("disabled");
|
|
}
|
|
}
|
|
|
|
// Filter by subscription id
|
|
function filterBySubscriptionId() {
|
|
|
|
selectedSubscription = $("#subscriptionidfilter").val();
|
|
selectedLibrary = $("#libraryfilter").val();
|
|
|
|
if (selectedSubscription == "all") {
|
|
clearFilters(true);
|
|
filterByLibrary();
|
|
} else {
|
|
|
|
// We hide everything
|
|
$("table.subscriptionstclass tbody tr").hide();
|
|
|
|
// Then show the lines that match the currently selected library
|
|
$("table.subscriptionstclass tbody tr td.libraryfilterclass:contains(" + selectedLibrary + ")").parent().show();
|
|
|
|
// Then hide the lines where the subscription id does not match the selected one
|
|
$("table.subscriptionstclass tbody tr td.subscriptionidfilterclass").not(
|
|
$("table.subscriptionstclass tbody tr td.subscriptionidfilterclass:contains(" + selectedSubscription + ")")
|
|
).parent().hide();
|
|
}
|
|
}
|
|
|
|
// Clears filters : reset everything
|
|
// (Though preserves the selected library if the keeplibrary parameter is set to true)
|
|
function clearFilters(keeplibrary) {
|
|
|
|
// Show all content
|
|
$("table.subscriptionstclass tbody tr").show();
|
|
|
|
// Remove old subscription options
|
|
$("#subscriptionidfilter option").remove();
|
|
$("#subscriptionidfilter option").append('<option value="all">'+_("(All)")+'</option>');
|
|
$("#subscriptionidfilter").attr("disabled", "disabled");
|
|
|
|
if (keeplibrary != true) {
|
|
// Reinit library options
|
|
initFilters();
|
|
$("#libraryfilter option[value=all]").attr("selected", "selected");
|
|
}
|
|
}
|
|
function showlayer(numlayer){
|
|
$(".yeardata").each(function(){
|
|
ong = $(this).attr("id");
|
|
if(ong == "show"+numlayer){
|
|
$(this).show();
|
|
currentYear = ong;
|
|
} else {
|
|
$(this).hide();
|
|
}
|
|
});
|
|
clearFilters();
|
|
}
|
|
//]]>
|
|
</script>
|
|
[% END %]
|