3199cff639
1. Hit /cgi-bin/koha/acqui/booksellers.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> vendor search box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on vendor search box.
6. Notice it is no longer executed.
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
225 lines
11 KiB
Text
225 lines
11 KiB
Text
[% USE KohaDates %]
|
|
[% INCLUDE 'doc-head-open.inc' %]
|
|
<title>Koha › Search for vendor [% supplier %]</title>
|
|
[% INCLUDE 'doc-head-close.inc' %]
|
|
<style type="text/css">
|
|
#vendors td{
|
|
vertical-align: top;
|
|
}
|
|
</style>
|
|
<link rel="stylesheet" href="[% interface %]/[% theme %]/css/datatables.css" />
|
|
[% INCLUDE 'datatables.inc' %]
|
|
<script type="text/javascript">
|
|
//<![CDATA[
|
|
$(document).ready(function() {
|
|
$("table.baskets").dataTable($.extend(true, {}, dataTablesDefaults, {
|
|
'sDom': 't',
|
|
'bPaginate': false,
|
|
'bFilter': false,
|
|
'bInfo': false,
|
|
"aaSorting": [[ 1, "asc" ]],
|
|
"aoColumnDefs": [
|
|
{ "sType": "title-string", "aTargets" : [ "title-string" ] },
|
|
{ "sType": "title-numeric", "aTargets" : [ "title-numeric" ] },
|
|
{ 'aTargets': [-1], 'bSortable': false }
|
|
]
|
|
}));
|
|
$("#supplierlist").change(function() {
|
|
var id = $(this).find("option:selected").val();
|
|
window.location.href = "#" + id;
|
|
});
|
|
$(".modal").on("show", function(){
|
|
var basket = $(this).data("basketno");
|
|
var legend = _("Add order to basket %s").format(basket);
|
|
$(this).find("legend").html(legend);
|
|
});
|
|
$("#show_all_vendors").hide();
|
|
$("#show_active_vendors").on('click', function(e){
|
|
e.preventDefault();
|
|
$(".inactive").hide();
|
|
$("#show_active_vendors").hide();
|
|
$("#show_all_vendors").show();
|
|
});
|
|
$("#show_all_vendors").on('click', function(e){
|
|
e.preventDefault();
|
|
$(".inactive").show();
|
|
$("#show_all_vendors").hide();
|
|
$("#show_active_vendors").show();
|
|
});
|
|
});
|
|
//]]>
|
|
</script>
|
|
|
|
</head>
|
|
<body id="acq_booksellers" class="acq">
|
|
[% INCLUDE 'header.inc' %]
|
|
[% INCLUDE 'acquisitions-search.inc' %]
|
|
|
|
<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> › <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> › Search for vendor <em>[% supplier |html %]</em> </div>
|
|
|
|
<div id="doc3" class="yui-t2">
|
|
|
|
<div id="bd">
|
|
<div id="yui-main">
|
|
<div class="yui-b">
|
|
|
|
[% INCLUDE 'acquisitions-toolbar.inc' %]
|
|
[% UNLESS ( count == 1 ) %]
|
|
[% UNLESS count %]
|
|
<h1>Your search returned no results.</h1>
|
|
[% ELSIF ( supplier.length < 1 ) %]
|
|
<h1>Vendor search: [% count %] results found</h1>
|
|
[% ELSE %]
|
|
<h1>Vendor search: [% count %] results found for '[% supplier %]'</h1>
|
|
[% END %]
|
|
[% END %]
|
|
[% IF ( loop_suppliers.size ) %]
|
|
[% UNLESS (count == 1) %]
|
|
<p>Choose a vendor in the list to jump directly to the right place.
|
|
<select id="supplierlist">
|
|
[% FOREACH supplier1 IN loop_suppliers %]
|
|
<option value="[% supplier1.booksellerid %]">[% supplier1.name %]</option>
|
|
[% END %]
|
|
</select>
|
|
</p>
|
|
[% END %]
|
|
[% IF ( allbaskets ) %]
|
|
<a href="/cgi-bin/koha/acqui/booksellers.pl?supplier=[% supplier %]&booksellerid=[% booksellerid %]">Show active baskets only</a>
|
|
[% ELSE %]
|
|
<a href="/cgi-bin/koha/acqui/booksellers.pl?supplier=[% supplier %]&booksellerid=[% booksellerid %]&allbaskets=1">Show all baskets</a>
|
|
[% END %]
|
|
[% UNLESS booksellerid %]
|
|
| <a href="#" id="show_active_vendors">Show active vendors only</a><a href="#" id="show_all_vendors">Show all vendors</a>
|
|
[% END %]
|
|
<div id="acqui_order_supplierlist">
|
|
[% FOREACH supplier IN loop_suppliers %]
|
|
[% IF ( supplier.active ) %]
|
|
<div class="supplier">
|
|
[% ELSE %]
|
|
<div class="supplier inactive">
|
|
[% END %]
|
|
<span class="suppliername">
|
|
[% IF (supplier.name) %]
|
|
<a name="[% supplier.booksellerid %]" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% supplier.booksellerid %]">[% supplier.name %]</a>
|
|
[% ELSE %]
|
|
<a name="[% supplier.booksellerid %]" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% supplier.booksellerid %]">NO NAME</a>
|
|
[% END %]
|
|
</span>
|
|
<span class="action">
|
|
[% IF ( CAN_user_acquisition_order_manage ) %]
|
|
[% IF ( supplier.active ) %]
|
|
<a class="btn btn-default btn-sm" href="/cgi-bin/koha/acqui/basketheader.pl?booksellerid=[% supplier.booksellerid %]&op=add_form"><i class="fa fa-plus"></i> New basket</a>
|
|
[% ELSE %]
|
|
(inactive)
|
|
[% END %]
|
|
[% END %]
|
|
[% IF ( supplier.loop_basket.size ) %]
|
|
<a class="btn btn-default btn-sm" href="/cgi-bin/koha/acqui/parcels.pl?booksellerid=[% supplier.booksellerid %]"><i class="fa fa-inbox"></i> Receive shipment</a>
|
|
[% END %]
|
|
</span>
|
|
<div class="baskets">
|
|
[% IF ( supplier.loop_basket.size ) %]
|
|
<table class="baskets">
|
|
<thead>
|
|
<tr>
|
|
<th>No.</th>
|
|
<th>Name</th>
|
|
<th class="title-numeric">Item count</th>
|
|
<th class="title-numeric">Biblio count</th>
|
|
<th>Items expected</th>
|
|
<th>Created by</th>
|
|
<th class="title-string">Date</th>
|
|
<th>Basket group</th>
|
|
<th class="title-string">Closed</th>
|
|
<th>Actions</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
[% FOREACH basket IN supplier.loop_basket %]
|
|
[% IF ( basket.uncertainprices ) %]
|
|
<tr class="problem">
|
|
[% ELSE %]
|
|
<tr>
|
|
[% END %]
|
|
<td>[% basket.basketno %]</td>
|
|
<td>[% basket.basketname %]</td>
|
|
<td>
|
|
<span title="[% basket.total_items %]">[% basket.total_items %]
|
|
[% IF basket.total_items_cancelled %]
|
|
([% basket.total_items_cancelled %] cancelled)
|
|
[% END %]
|
|
</span>
|
|
</td>
|
|
<td>
|
|
<span title="[% basket.total_biblios %]">[% basket.total_biblios %]
|
|
[% IF basket.total_biblios_cancelled %]
|
|
([% basket.total_biblios_cancelled %] cancelled)
|
|
[% END %]
|
|
</span>
|
|
</td>
|
|
<td>[% basket.expected_items %]</td>
|
|
<td>
|
|
[% basket.authorisedby_firstname %]
|
|
[% basket.authorisedby_surname %]
|
|
</td>
|
|
<td><span title="[% basket.creationdate %]">[% basket.creationdate | $KohaDates %]</span></td>
|
|
<td>
|
|
[% IF basket.basketgroup %]
|
|
[% basketgroup = basket.basketgroup %]
|
|
[% IF basketgroup.closed %]
|
|
[% basketgroup.name %] (closed)
|
|
[% ELSE %]
|
|
<a href="/cgi-bin/koha/acqui/basketgroup.pl?op=add&booksellerid=[% basket.booksellerid %]&basketgroupid=[% basketgroup.id %]">[% basketgroup.name %]</a>
|
|
[% END %]
|
|
[% END %]
|
|
</td>
|
|
<td>
|
|
[% IF ( basket.closedate ) %]
|
|
<span title="[% basket.closedate %]">[% basket.closedate | $KohaDates %]</span>
|
|
[% ELSE %]
|
|
<span title="9999-99-99"></span>
|
|
[% END %]
|
|
</td>
|
|
<td class="actions">
|
|
<a class="btn btn-default btn-xs" href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basket.basketno %]"><i class="fa fa-eye"></i> View</a>
|
|
|
|
[% IF not basket.closedate and supplier.active %]
|
|
<a class="btn btn-default btn-xs" id="addtoBasketLabel[% basket.basketno %]" href="#addtoBasket[% basket.basketno %]" role="button" data-toggle="modal"><i class="fa fa-plus"></i> Add to basket</a>
|
|
<!-- Modal -->
|
|
<div id="addtoBasket[% basket.basketno %]" class="modal" tabindex="-1" role="dialog" aria-labelledby="addtoBasketLabel[% basket.basketno %]" aria-hidden="true" data-basketno="[% basket.basketname %]">
|
|
<div class="modal-dialog">
|
|
<div class="modal-content">
|
|
<div class="modal-body">
|
|
[% INCLUDE 'acquisitions-add-to-basket.inc' booksellerid=supplier.booksellerid basketno=basket.basketno %]
|
|
</div>
|
|
<div class="modal-footer">
|
|
<a href="#" class="cancel" data-dismiss="modal" aria-hidden="true">Cancel</a>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
[% END %]
|
|
</td>
|
|
</tr>
|
|
[% END %][%# FOREACH basket IN supplier.loop_basket %]
|
|
</tbody>
|
|
</table>
|
|
|
|
[% ELSE %]
|
|
<p>No pending baskets</p>
|
|
[% END %][%# IF ( supplier.loop_basket.size ) %]
|
|
</div>
|
|
</div>
|
|
[% END %][%# FOREACH supplier IN loop_suppliers %]
|
|
</div>
|
|
[% END %][%# IF ( loop_suppliers.size ) %]
|
|
</div>
|
|
</div>
|
|
<div class="yui-b">
|
|
[% IF ( booksellerid ) %]
|
|
[% INCLUDE 'vendor-menu.inc' %]
|
|
[% END %]
|
|
[% INCLUDE 'acquisitions-menu.inc' %]
|
|
</div>
|
|
</div>
|
|
[% INCLUDE 'intranet-bottom.inc' %]
|