dcd1f5d48c
Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
399 lines
25 KiB
Text
399 lines
25 KiB
Text
[% USE raw %]
|
|
[% USE Asset %]
|
|
[% USE Branches %]
|
|
[% USE Price %]
|
|
[% INCLUDE 'doc-head-open.inc' %]
|
|
<title>Koha › Basket grouping for [% booksellername | html %]</title>
|
|
[% Asset.css("css/datatables.css") | $raw %]
|
|
[% INCLUDE 'doc-head-close.inc' %]
|
|
[% INCLUDE 'datatables.inc' %]
|
|
[% Asset.js("lib/yui/utilities/utilities.js") | $raw %]
|
|
[% Asset.js("lib/yui/button/button-min.js") | $raw %]
|
|
[% Asset.js("lib/yui/container/container_core-min.js") | $raw %]
|
|
[% Asset.js("lib/yui/menu/menu-min.js") | $raw %]
|
|
[% Asset.js("js/basketgroup.js") | $raw %]
|
|
[% IF ( grouping ) %]
|
|
[% Asset.js("lib/yui/yahoo-dom-event/yahoo-dom-event.js") | $raw %]
|
|
[% Asset.js("lib/yui/animation/animation-min.js") | $raw %]
|
|
[% Asset.js("lib/yui/dragdrop/dragdrop-min.js") | $raw %]
|
|
[% Asset.js("lib/yui/element/element-min.js") | $raw %]
|
|
<style type="text/css">
|
|
/*margin and padding on body element
|
|
can introduce errors in determining
|
|
element position and are not recommended;
|
|
we turn them off as a foundation for YUI
|
|
CSS treatments. */
|
|
|
|
#ungrouped {
|
|
overflow: auto;
|
|
height: 400px;
|
|
}
|
|
|
|
.draglist{
|
|
width: 200px;
|
|
height: 300px;
|
|
overflow: auto;
|
|
}
|
|
|
|
div.workarea_alt { padding: 5px; float:left; width: 95%;}
|
|
div.closed { background-color: pink; padding:10px; float:left; width: 45%;}
|
|
|
|
ul.draglist {
|
|
position: relative;
|
|
background: #EEE;
|
|
padding-bottom:10;
|
|
border: 1px inset gray;
|
|
list-style: none;
|
|
margin:0;
|
|
padding: 5px;
|
|
}
|
|
|
|
ul.draglist li {
|
|
margin: 1px;
|
|
cursor: move;
|
|
list-style: none;
|
|
}
|
|
|
|
ul.draglist_alt {
|
|
position: relative;
|
|
border: 1px solid gray;
|
|
list-style: none;
|
|
margin: 0;
|
|
background: #f7f7f7;
|
|
padding: 5px;
|
|
cursor: move;
|
|
}
|
|
|
|
ul.draglist_alt li {
|
|
margin: 1px;
|
|
list-style: none;
|
|
}
|
|
|
|
li.grouped {
|
|
background-color: #D1E6EC;
|
|
border:1px solid #7EA6B2;
|
|
list-style: none;
|
|
}
|
|
|
|
li.ungrouped {
|
|
background-color: #D8D4E2;
|
|
border:1px solid #6B4C86;
|
|
}
|
|
|
|
fieldset.various li {
|
|
list-style: none;
|
|
clear: none;
|
|
}
|
|
|
|
</style>
|
|
[% END %]
|
|
<script type="text/javascript">
|
|
//<![CDATA[
|
|
YAHOO.util.Event.onDOMReady(DDApp.init, DDApp, true);
|
|
|
|
var MSG_CONFIRM_CLOSE_BASKETGROUP = _("Are you sure you want to close this basketgroup?");
|
|
var MSG_CLOSE_EMPTY_BASKET = _("Why close an empty basket?");
|
|
var MSG_SAVE_BEFORE_PRINTING = _("You need to save the page before printing");
|
|
var MSG_REOPEN_BASKETGROUP = _("reopen basketgroup");
|
|
var MSG_FILE_DOWNLOAD_ERROR = _("Error downloading the file");
|
|
|
|
function submitForm(form) {
|
|
if (form.close.checked == true) {
|
|
var input = document.createElement("input");
|
|
input.setAttribute("type", "hidden");
|
|
input.setAttribute("name", "closed");
|
|
input.setAttribute("value", "1");
|
|
form.appendChild(input);
|
|
}
|
|
}
|
|
|
|
$(document).ready(function() {
|
|
$("#basket_groups").tabs();
|
|
|
|
$("table").dataTable($.extend(true, {}, dataTablesDefaults, {
|
|
"aoColumnDefs": [
|
|
{ "aTargets": [ -1 ], "bSortable": false, "bSearchable": false },
|
|
],
|
|
"bAutoWidth": false,
|
|
"sPaginationType": "four_button"
|
|
} ));
|
|
|
|
});
|
|
|
|
|
|
//]]>
|
|
</script>
|
|
</head>
|
|
<body id="acq_basketgroup" class="acq">
|
|
[% INCLUDE 'header.inc' %]
|
|
[% INCLUDE 'acquisitions-search.inc' %]
|
|
|
|
<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> › <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> ›
|
|
[% IF ( grouping ) %]
|
|
<a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% booksellername | html %]</a> › <a href="/cgi-bin/koha/acqui/basketgroup.pl?booksellerid=[% booksellerid | html %]">Basket grouping</a> › Add basket group for [% booksellername | html %]</div>
|
|
[% ELSE %]
|
|
<a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% booksellername | html %]</a> › Basket grouping</div>
|
|
[% END %]
|
|
|
|
|
|
<div class="main container-fluid">
|
|
<div class="row">
|
|
<div class="col-sm-10 col-sm-push-2">
|
|
<main>
|
|
|
|
[% IF ( grouping ) %]
|
|
[% IF (closedbg) %]
|
|
<div id="toolbar" class="btn-toolbar">
|
|
<div class="btn-group"><a href="[% script_name | html %]?op=reopen&basketgroupid=[% basketgroupid | html %]&booksellerid=[% booksellerid | html %]&mode=singlebg" class="btn btn-default btn-sm" id="reopenbutton"><i class="fa fa-download"></i> Reopen this basket group</a></div>
|
|
<div class="btn-group"><a href="[% script_name | html %]?op=export&basketgroupid=[% basketgroupid | html %]&booksellerid=[% booksellerid | html %]" class="btn btn-default btn-sm" id="exportbutton"><i class="fa fa-download"></i> Export this basket group as CSV</a></div>
|
|
<div class="btn-group"><a href="[% script_name | html %]?op=print&basketgroupid=[% basketgroupid | html %]&booksellerid=[% booksellerid | html %]" class="btn btn-default btn-sm" id="printbutton"><i class="fa fa-download"></i> Print this basket group in PDF</a></div>
|
|
<div class="btn-group"><a href="[% script_name | html %]?op=ediprint&basketgroupid=[% basketgroupid | html %]&booksellerid=[% booksellerid | html %]" class="btn btn-default btn-sm" id="printbutton"><i class="fa fa-download"></i> Generate EDIFACT order</a></div>
|
|
</div>
|
|
[% END %]
|
|
[% IF (name && closedbg) %]
|
|
<h1>Basket group [% name | html %] ([% basketgroupid | html %]) for <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% booksellername | html %]</a></h1>
|
|
[% ELSIF (name) %]
|
|
<h1>Edit basket group [% name | html %] ([% basketgroupid | html %]) for <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% booksellername | html %]</a></h1>
|
|
[% ELSE %]
|
|
<h1>Add basket group for <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% booksellername | html %]</a></h1>
|
|
[% END %]
|
|
<div id="basketgroupcolumns" class="row">
|
|
[% UNLESS (closedbg) %]
|
|
<div class="col-xs-6 col-xs-push-6">
|
|
<form action="[% scriptname | html %]" method="post" name="basketgroups" id="basketgroups">
|
|
<div id="groups">
|
|
<fieldset class="brief">
|
|
<div class="workarea_alt" >
|
|
<h3>Ungrouped baskets</h3>
|
|
<ul id="ungrouped" class="draglist_alt">
|
|
[% IF ( baskets ) %]
|
|
[% FOREACH basket IN baskets %]
|
|
<li class="ungrouped" id="b-[% basket.basketno | html %]" >
|
|
<a href="basket.pl?basketno=[% basket.basketno | html %]">
|
|
[% IF ( basket.basketname ) %]
|
|
[% basket.basketname | html %]
|
|
[% ELSE %]
|
|
No name, basketnumber: [% basket.basketno | html %]
|
|
[% END %]
|
|
</a>, <br />
|
|
Total: [% basket.total | $Price | html %]
|
|
<input type="hidden" class="basket" name="basket" value="[% basket.basketno | html %]" />
|
|
</li>
|
|
[% END %]
|
|
[% END %]
|
|
</ul>
|
|
</div>
|
|
</fieldset>
|
|
</div>
|
|
</form>
|
|
</div>
|
|
[% END %]
|
|
[% IF ( closedbg ) %]
|
|
<div class="col-xs-12">
|
|
[% ELSE %]
|
|
<div class="col-xs-6 col-xs-pull-6">
|
|
[% END %]
|
|
<form action="" method="post" id="groupingform" onsubmit="return submitForm(this)">
|
|
<fieldset id="various" class="brief">
|
|
<ol>
|
|
[% UNLESS (closedbg) %]
|
|
<li>
|
|
<label for="basketgroupname">Basket group name:</label>
|
|
<input type="text" name="basketgroupname" id="basketgroupname" value="[% name | html %]" class="focus" />
|
|
</li>
|
|
[% ELSE %]
|
|
<input type="hidden" name="basketgroupname" id="basketgroupname" value="[% name | html %]" />
|
|
[% END %]
|
|
<li>
|
|
[% UNLESS (closedbg) %]
|
|
<label for="billingplace">Billing place:</label>
|
|
<select name="billingplace" id="billingplace">
|
|
<option value="">--</option>
|
|
[% PROCESS options_for_libraries libraries => Branches.all( selected => billingplace ) %]
|
|
</select>
|
|
[% ELSE %]
|
|
<span class="label">Billing place:</span>
|
|
<input name="billingplace" id="billingplace" type ="hidden" value="[% billingplace | html %]" />[% Branches.GetName( billingplace ) | html %]
|
|
[% END %]
|
|
</li>
|
|
[% UNLESS (closedbg) %]
|
|
<li>
|
|
<label for="deliveryplace">Delivery place:</label>
|
|
<select name="deliveryplace" id="deliveryplace">
|
|
<option value="">--</option>
|
|
[% PROCESS options_for_libraries libraries => Branches.all( selected => deliveryplace ) %]
|
|
</select>
|
|
</li>
|
|
<li><p>or</p></li>
|
|
<li>
|
|
<label for="freedeliveryplace">Delivery place:</label>
|
|
<textarea cols="26" rows="3" name="freedeliveryplace" id="freedeliveryplace">[% freedeliveryplace | html %]</textarea>
|
|
</li>
|
|
[% ELSE %]
|
|
<li>
|
|
<span class="label">Delivery place:</span>
|
|
[% IF (freedeliveryplace) %]
|
|
<input name="freedeliveryplace" id="freedeliveryplace" type ="hidden" value="[% freedeliveryplace | html %]" />[% freedeliveryplace | html %]
|
|
<input name="deliveryplace" id="deliveryplace" type ="hidden" value="" />
|
|
[% ELSE %]
|
|
<input name="deliveryplace" id="deliveryplace" type ="hidden" value="[% deliveryplace | html %]" />[% Branches.GetName( deliveryplace ) | html %]
|
|
<input name="freedeliveryplace" id="freedeliveryplace" type ="hidden" value="" />
|
|
[% END %]
|
|
</li>
|
|
[% END %]
|
|
<li>
|
|
[% UNLESS (closedbg) %]
|
|
<label for="deliverycomment">Delivery comment:</label>
|
|
<textarea cols="26" rows="3" name="deliverycomment" id="deliverycomment">[% deliverycomment | html %]</textarea>
|
|
[% ELSE %]
|
|
<span class="label">Delivery comment:</span>[% deliverycomment | html %]
|
|
<input name="deliverycomment" id="deliverycomment" type="hidden" value = "[% deliverycomment | html %]" />
|
|
[% END %]
|
|
</li>
|
|
<li>
|
|
<span class="label">Baskets in this group:</span>
|
|
[% UNLESS (closedbg) %]
|
|
<ul class="draglist" id="bg">
|
|
[% ELSE %]
|
|
<ul>
|
|
[% END %]
|
|
[% FOREACH selectedbasket IN selectedbaskets %]
|
|
<li class="grouped" id="b-[% selectedbasket.basketno | html %]" >
|
|
<a href="basket.pl?basketno=[% selectedbasket.basketno | html %]">
|
|
[% IF ( selectedbasket.basketname ) %]
|
|
[% selectedbasket.basketname | html %]
|
|
[% ELSE %]
|
|
No name, basketnumber: [% selectedbasket.basketno | html %]
|
|
[% END %]
|
|
</a>, <br />
|
|
Total: [% selectedbasket.total | $Price | html %]
|
|
<input type="hidden" class="basket" name="basket" value="[% selectedbasket.basketno | html %]" />
|
|
</li>
|
|
[% END %]
|
|
</ul>
|
|
</li>
|
|
[% UNLESS (closedbg) %]
|
|
<li><label><input type="checkbox" id="closedbg" name="closedbg" />Close basket group</label></li>
|
|
[% ELSE %]
|
|
<input type="hidden" id="closedbg" name="closedbg" value ="1"/>
|
|
[% END %]
|
|
</ol>
|
|
</fieldset>
|
|
[% UNLESS (closedbg) %]
|
|
<fieldset class="action"><input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
|
|
[% IF ( basketgroupid ) %]
|
|
<input type="hidden" name="basketgroupid" value="[% basketgroupid | html %]" />
|
|
[% END %]
|
|
<input type="hidden" name="op" value="attachbasket" />
|
|
<input type="submit" value="Save" /> <a href="/cgi-bin/koha/acqui/basketgroup.pl?booksellerid=[% booksellerid | html %]" class="cancel">Cancel</a>
|
|
</fieldset>
|
|
[% END %]
|
|
</form>
|
|
</div>
|
|
</div>
|
|
[% ELSE %]
|
|
<div id="toolbar" class="btn-toolbar">
|
|
<div class="btn-group"><a href="/cgi-bin/koha/acqui/basketgroup.pl?op=add&booksellerid=[% booksellerid | html %]" class="btn btn-default btn-sm" id="newbasketgroup"><i class="fa fa-plus"></i> New basket group</a></div>
|
|
</div>
|
|
<h1>Basket grouping for <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% booksellername | html %]</a></h1>
|
|
<div id="basket_groups" class="toptabs">
|
|
<ul class="ui-tabs-nav">
|
|
[% UNLESS ( listclosed) %]<li class="ui-tabs-active"><a href="#opened">Open</a></li>
|
|
[% ELSE%]<li><a href="#opened">Open</a></li>[% END %]
|
|
[% IF ( listclosed) %]<li class="ui-tabs-active"><a href="#closed">Closed</a></li>
|
|
[% ELSE %]<li><a href="#closed">Closed</a></li>[% END %]
|
|
</ul>
|
|
<div id="opened">
|
|
<table id="basket_group_opened">
|
|
<thead>
|
|
<tr>
|
|
<th>Name</th>
|
|
<th>Number</th>
|
|
<th>Billing place</th>
|
|
<th>Delivery place</th>
|
|
<th>Number of baskets</th>
|
|
<th>Action</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
[% FOREACH basketgroup IN basketgroups %]
|
|
[% UNLESS ( basketgroup.closed ) %]
|
|
<tr>
|
|
<td>[% IF ( basketgroup.name ) %]
|
|
[% basketgroup.name | html %]
|
|
[% ELSE %]
|
|
Basket group no. [% basketgroup.id | html %]
|
|
[% END %]
|
|
</td>
|
|
<td>[% basketgroup.id | html %]</td>
|
|
<td>[% Branches.GetName( basketgroup.billingplace ) | html %]</td>
|
|
<td>[% IF (basketgroup.freedeliveryplace) %]Free delivery place[% ELSE %][% Branches.GetName( basketgroup.deliveryplace ) | html %][% END %]</td>
|
|
<td>[% basketgroup.basketsqty | html %]</td>
|
|
<td>
|
|
<input type="button" onclick="closeandprint('[% basketgroup.id | html %]');" value="Close and export as PDF" />
|
|
<form action="/cgi-bin/koha/acqui/basketgroup.pl" method="get"><input type="hidden" name="op" value="add" /><input type="hidden" name="booksellerid" value="[% basketgroup.booksellerid | html %]" /><input type="hidden" name="basketgroupid" value="[% basketgroup.id | html %]" /><input type="submit" value="Edit" /></form>
|
|
[% UNLESS basketgroup.basketsqty %]
|
|
<form action="/cgi-bin/koha/acqui/basketgroup.pl" method="get"><input type="hidden" name="op" value="delete" /><input type="hidden" name="booksellerid" value="[% basketgroup.booksellerid | html %]" /><input type="hidden" name="basketgroupid" value="[% basketgroup.id | html %]" /><input type="submit" value="Delete" /></form>
|
|
[% END %]
|
|
</td>
|
|
</tr>
|
|
[% END %]
|
|
[% END %]
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
<div id="closed">
|
|
<table id="basket_group_closed">
|
|
<thead>
|
|
<tr>
|
|
<th>Name</th>
|
|
<th>Number</th>
|
|
<th>Billing place</th>
|
|
<th>Delivery place</th>
|
|
<th>Number of baskets</th>
|
|
<th>Action</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
[% FOREACH basketgroup IN basketgroups %]
|
|
[% IF ( basketgroup.closed ) %]
|
|
<tr>
|
|
<td>
|
|
[% IF ( basketgroup.name ) %]
|
|
[% basketgroup.name | html %]
|
|
[% ELSE %]
|
|
Basket group no. [% basketgroup.id | html %]
|
|
[% END %]
|
|
</td>
|
|
<td>[% basketgroup.id | html %]</td>
|
|
<td>[% Branches.GetName( basketgroup.billingplace ) | html %]</td>
|
|
<td>[% IF (basketgroup.freedeliveryplace) %]Free delivery place[% ELSE %][% Branches.GetName( basketgroup.deliveryplace ) | html %][% END %]</td>
|
|
<td>[% basketgroup.basketsqty | html %]</td>
|
|
<td>
|
|
<form action="/cgi-bin/koha/acqui/basketgroup.pl" method="get"><input type="hidden" name="op" value="add" /><input type="hidden" name="booksellerid" value="[% basketgroup.booksellerid | html %]" /><input type="hidden" name="basketgroupid" value="[% basketgroup.id | html %]" /><input type="submit" value="View" /></form>
|
|
<form action="/cgi-bin/koha/acqui/basketgroup.pl" method="get"><input type="hidden" name="op" value="reopen" /><input type="hidden" name="booksellerid" value="[% basketgroup.booksellerid | html %]" /><input type="hidden" name="basketgroupid" value="[% basketgroup.id | html %]" /><input type="submit" value="Reopen" /></form>
|
|
<form action="/cgi-bin/koha/acqui/basketgroup.pl" method="get"><input type="hidden" name="op" value="print" /><input type="hidden" name="basketgroupid" value="[% basketgroup.id | html %]" /><input type="submit" value="Export as PDF" /></form>
|
|
<form action="/cgi-bin/koha/acqui/basketgroup.pl" method="get"><input type="hidden" name="op" value="export" /><input type="hidden" name="basketgroupid" value="[% basketgroup.id | html %]" /><input type="submit" value="Export as CSV" /></form>
|
|
<form action="/cgi-bin/koha/acqui/basketgroup.pl" method="get"><input type="hidden" name="op" value="ediprint" /><input type="hidden" name="basketgroupid" value="[% basketgroup.id | html %]" /><input type="submit" value="Generate EDIFACT order" /></form>
|
|
</td>
|
|
</tr>
|
|
[% END %]
|
|
[% END %]
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</div>
|
|
[% END %]
|
|
</main>
|
|
</div> <!-- /.col-sm-10.col-sm-push-2 -->
|
|
|
|
<div class="col-sm-2 col-sm-pull-10">
|
|
<aside>
|
|
[% IF ( booksellerid ) %]
|
|
[% INCLUDE 'vendor-menu.inc' %]
|
|
[% END %]
|
|
[% INCLUDE 'acquisitions-menu.inc' %]
|
|
</aside>
|
|
</div>
|
|
</div> <!-- /.row -->
|
|
[% INCLUDE 'intranet-bottom.inc' %]
|