Bugzilla – Attachment 84862 Details for
Bug 21063
Allow columns in intranet ILL request datatable to be customisable
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 21063: (follow-up) Sanitize datatable data
Bug-21063-follow-up-Sanitize-datatable-data.patch (text/plain), 4.05 KB, created by
Andrew Isherwood
on 2019-02-08 11:15:30 UTC
(
hide
)
Description:
Bug 21063: (follow-up) Sanitize datatable data
Filename:
MIME Type:
Creator:
Andrew Isherwood
Created:
2019-02-08 11:15:30 UTC
Size:
4.05 KB
patch
obsolete
>From 763c39a8bfa95462f692821be89fb4320d1e0485 Mon Sep 17 00:00:00 2001 >From: Andrew Isherwood <andrew.isherwood@ptfs-europe.com> >Date: Fri, 8 Feb 2019 11:12:45 +0000 >Subject: [PATCH] Bug 21063: (follow-up) Sanitize datatable data > >This mitigates bug 22268 by sanitizing data prior to display using the >built in $.fn.dataTable.render.text() helper provided by Datatables. > >The patch was added here, rather that in 22268 since this is the bug >that introduced the problem by increasing the number of fields that are >displayed in the table, some of which could contain user provided >malicious data >--- > .../prog/en/modules/ill/ill-requests.tt | 38 ++++++++++++++++++++-- > 1 file changed, 35 insertions(+), 3 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt >index fa941640c9..ea07d069d2 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt >@@ -795,7 +795,8 @@ > // Columns that require special treatment > var specialCols = { > action: { >- func: createActionLink >+ func: createActionLink, >+ skipSanitize: true > }, > borrowernumber: { > func: createPatronLink >@@ -808,7 +809,8 @@ > }, > biblio_id: { > name: _("Bibliograpic record ID"), >- func: createBiblioLink >+ func: createBiblioLink, >+ skipSanitize: true > }, > metadata_Type: { > func: createType >@@ -818,6 +820,9 @@ > }, > patron_cardnumber: { > name: _("Cardnumber") >+ }, >+ patron: { >+ skipSanitize: true > } > }; > >@@ -855,6 +860,21 @@ > e.preventDefault(); > $('#dataPreview').modal({show:true}); > }); >+ >+ // Allow us to chain Datatable render helpers together, so we >+ // can use our custom functions and render.text(), which >+ // provides us with data sanitization >+ $.fn.dataTable.render.multi = function(renderArray) { >+ return function(d, type, row, meta) { >+ for(var r = 0; r < renderArray.length; r++) { >+ var toCall = renderArray[r].hasOwnProperty('display') ? >+ renderArray[r].display : >+ renderArray[r]; >+ d = toCall(d, type, row, meta); >+ } >+ return d; >+ } >+ } > > // Get our data from the API and process it prior to passing > // it to datatables >@@ -888,9 +908,21 @@ > specialCols.hasOwnProperty(colName) && > specialCols[colName].hasOwnProperty('func') > ) { >- colObj.render = specialCols[colName].func; >+ var renderArray = [ >+ specialCols[colName].func >+ ]; >+ if (!specialCols[colName].skipSanitize) { >+ renderArray.push( >+ $.fn.dataTable.render.text() >+ ); >+ } >+ >+ colObj.render = $.fn.dataTable.render.multi( >+ renderArray >+ ); > } else { > colObj.data = colName; >+ colObj.render = $.fn.dataTable.render.text() > } > // Make sure properties that aren't present in the API > // response are populated with null to avoid Datatables >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 21063
:
76940
|
76941
|
76942
|
76943
|
79559
|
79560
|
80690
|
80691
|
80802
|
80841
|
82153
|
82154
|
82155
|
82156
|
82504
|
82505
|
82506
|
82507
|
84405
|
84786
|
84787
|
84788
|
84789
|
84790
|
84862
|
85854
|
85855
|
85869
|
85889
|
85893
|
85894
|
85895
|
85896
|
86060
|
86092
|
86093
|
86094
|
86095
|
86096
|
86097
|
86098
|
86099
|
86100
|
86101
|
86102
|
86103
|
86104
|
86105
|
86106
|
86235