From ca1efafa62883c4c64db8a34ffe576d6b4a1bcc8 Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Fri, 18 Aug 2023 04:32:31 +0000
Subject: [PATCH] Bug 34571: Remove use of "onclick" for ExpandField in
 cataloguing editors

This change replaces the onclick HTML attribute with a Javascript binding
to make it more in line with Koha conventions and make it CSP compatible.

Test plan:
0. Apply patch
1. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?frameworkcode=#
2. Try hiding/unhiding fields
3. Try cloning fields and hiding/unhiding those too
4. Note that everything works as expected
5. Do the same thing for authorities by going to
http://localhost:8081/cgi-bin/koha/authorities/authorities.pl?authtypecode=#

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 8341ffe13db350f3d0c623e1f6ff6671e1944d82)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 8237fdd32a6519ce063f3e119874e89395aec379)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
---
 .../prog/en/modules/authorities/authorities.tt       | 12 ++++++++++--
 .../prog/en/modules/cataloguing/addbiblio.tt         |  9 +++++++--
 koha-tmpl/intranet-tmpl/prog/js/cataloging.js        |  6 ++++--
 3 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt
index 1a417c835c..295fb77e68 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt
@@ -243,6 +243,14 @@
         $("#confirm_not_duplicate").attr("value","1");
         Check();
     }
+    /* Wrap a value in HTML without putting HTML in translatable string */
+    function formatFieldName( string ){
+        return "<strong><em>" + string + "</em></strong>";
+    }
+
+    $(document).ready(function(){
+        $('body').on('click','.expandfield',ExpandField);
+    });
 </script>
 [% Asset.css("css/addbiblio.css") | $raw %]
 
@@ -398,7 +406,7 @@
                                                 <div class="tag_title" id="div_indicator_tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]">
                                                     [% UNLESS hide_marc %]
                                                         [% IF advancedMARCEditor %]
-                                                            <a href="#" tabindex="1" class="tagnum" title="[% innerloo.tag_lib | html %] - Click to expand this tag" onclick="ExpandField('tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]'); return false;">[% innerloo.tag | html %]</a>
+                                                            <a href="#" tabindex="1" class="tagnum" title="[% innerloo.tag_lib | html %] - Click to expand this tag" data-field_id="tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]'">[% innerloo.tag | html %]</a>
                                                         [% ELSE %]
                                                             <span class="tagnum" title="[% innerloo.tag_lib | html %]">[% innerloo.tag | html %]</span>
                                                         [% END %]
@@ -458,7 +466,7 @@
                                                     [% END # /UNLESS hide_marc %]
 
                                                     [% UNLESS advancedMARCEditor %]
-                                                        <a href="#" tabindex="1" class="expandfield" onclick="ExpandField('tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]'); return false;" title="Click to expand this tag">[% innerloo.tag_lib | html %]</a>
+                                                        <a href="#" tabindex="1" class="expandfield" data-field_id="tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]" title="Click to expand this tag">[% innerloo.tag_lib | html %]</a>
                                                     [% END %]
                                                     <span class="field_controls">
                                                         [% IF ( innerloo.repeatable ) %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt
index 0a9042d917..f58826c1fc 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt
@@ -787,6 +787,11 @@ $(document).ready(function(){
     function formatFieldName( string ){
         return "<strong><em>" + string + "</em></strong>";
     }
+
+    $(document).ready(function(){
+        $('body').on('click','.expandfield',ExpandField);
+    });
+
 </script>
 [% Asset.css("css/addbiblio.css") | $raw %]
 </head>
@@ -1043,7 +1048,7 @@ $(document).ready(function(){
                                         [% END %]
                                             <div class="tag_title" id="div_indicator_tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]">
                                                 [% IF advancedMARCEditor %]
-                                                    <a href="#" tabindex="1" class="tagnum" title="[% innerloo.tag_lib | html %] - Click to expand this tag" onclick="ExpandField('tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]'); return false;">[% innerloo.tag | html %]</a>
+                                                    <a href="#" tabindex="1" class="tagnum" title="[% innerloo.tag_lib | html %] - Click to expand this tag" data-field_id="tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]">[% innerloo.tag | html %]</a>
                                                 [% ELSE %]
                                                     <span class="tagnum" title="[% innerloo.tag_lib | html %]">[% innerloo.tag | html %]</span>
                                                     <a href="#" class="marcdocs" data-tag="[% innerloo.tag | html %]">&nbsp;?</a>
@@ -1084,7 +1089,7 @@ $(document).ready(function(){
                                                 [% END # /IF innerloo.fixedfield %] -
 
                                                 [% UNLESS advancedMARCEditor %]
-                                                    <a href="#" tabindex="1" class="expandfield" onclick="ExpandField('tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]'); return false;" title="Click to expand this tag">[% innerloo.tag_lib | html %]</a>
+                                                    <a href="#" tabindex="1" class="expandfield" data-field_id="tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]" title="Click to expand this tag">[% innerloo.tag_lib | html %]</a>
                                                 [% END %]
 
                                                 <span class="field_controls">
diff --git a/koha-tmpl/intranet-tmpl/prog/js/cataloging.js b/koha-tmpl/intranet-tmpl/prog/js/cataloging.js
index d6f6715cc3..602ae9ceaf 100644
--- a/koha-tmpl/intranet-tmpl/prog/js/cataloging.js
+++ b/koha-tmpl/intranet-tmpl/prog/js/cataloging.js
@@ -59,7 +59,8 @@ function openAuth(tagsubfieldid,authtype,source) {
     window.open("../authorities/auth_finder.pl?source="+source+"&authtypecode="+authtype+"&index="+tagsubfieldid+"&value_mainstr="+encodeURIComponent(mainmainstring)+"&value_main="+encodeURIComponent(mainstring), "_blank",'width=700,height=550,toolbar=false,scrollbars=yes');
 }
 
-function ExpandField(index) {
+function ExpandField() {
+    let index = this.dataset.field_id;
     var original = document.getElementById(index); //original <li>
     var lis = original.getElementsByTagName('li');
     for(var i=0,lislen = lis.length ; i<lislen ; i++){   // foreach li
@@ -77,6 +78,7 @@ function ExpandField(index) {
             }
         }
     }
+    return false;
 }
 
 var current_select2;
@@ -307,7 +309,7 @@ function CloneField(index, hideMarc, advancedMARCEditor) {
                         } else if (anchors[j].getAttribute('class') == 'buttonMinus') {
                             anchors[j].setAttribute('onclick',"UnCloneField('" + new_id + "'); return false;");
                         } else if (anchors[j].getAttribute('class') == 'expandfield') {
-                            anchors[j].setAttribute('onclick',"ExpandField('" + new_id + "'); return false;");
+                            anchors[j].setAttribute('data-field_id',new_id);
                         }
                     }
                 }
-- 
2.39.5