Bugzilla – Attachment 92197 Details for
Bug 23451
Reflected XSS in opac-imageviewer.pl
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 23451: Fix other similar wrong filterings
Bug-23451-Fix-other-similar-wrong-filterings.patch (text/plain), 16.01 KB, created by
Jonathan Druart
on 2019-08-14 17:41:05 UTC
(
hide
)
Description:
Bug 23451: Fix other similar wrong filterings
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2019-08-14 17:41:05 UTC
Size:
16.01 KB
patch
obsolete
>From bd02e28c2c1f1b0d1f03b77f48e7ff6fa27b1566 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Wed, 14 Aug 2019 13:39:43 -0400 >Subject: [PATCH] Bug 23451: Fix other similar wrong filterings > >--- > koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt | 4 ++-- > koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt | 12 ++++++------ > .../intranet-tmpl/prog/en/modules/members/memberentrygen.tt | 2 +- > .../intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt | 2 +- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt | 4 ++-- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-results.tt | 2 +- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt | 2 +- > 7 files changed, 14 insertions(+), 14 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt >index eba096c688..d6ba7240ae 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt >@@ -262,7 +262,7 @@ > <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" /> > <input type="hidden" name="duedatespec" value="[% duedatespec | html %]" /> > <input type="hidden" name="stickyduedate" value="[% stickyduedate | html %]" /> >- <button class="print" type="submit" onclick="Dopop('hold-transfer-slip.pl?borrowernumber=[% reserveborrowernumber | html %]&biblionumber=[% itembiblionumber | html %]&itemnumber=[% item.itemnumber | html %]&op=slip');this.form.submit();"><i class="fa fa-print"></i> Don't check out and print slip (P)</button> >+ <button class="print" type="submit" onclick="Dopop('hold-transfer-slip.pl?borrowernumber=[% reserveborrowernumber | uri %]&biblionumber=[% itembiblionumber | uri %]&itemnumber=[% item.itemnumber | uri %]&op=slip');this.form.submit();"><i class="fa fa-print"></i> Don't check out and print slip (P)</button> > </form> > [% END %] > >@@ -272,7 +272,7 @@ > <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" /> > <input type="hidden" name="duedatespec" value="[% duedatespec | html %]" /> > <input type="hidden" name="stickyduedate" value="[% stickyduedate | html %]" /> >- <button class="print" type="submit" onclick="Dopop('hold-transfer-slip.pl?borrowernumber=[% reserveborrowernumber | html %]&biblionumber=[% itembiblionumber | html %]&itemnumber=[% item.itemnumber | html %]&op=slip');this.form.submit();"><i class="fa fa-print"></i> Don't check out and print slip (P)</button> >+ <button class="print" type="submit" onclick="Dopop('hold-transfer-slip.pl?borrowernumber=[% reserveborrowernumber | uri %]&biblionumber=[% itembiblionumber | uri %]&itemnumber=[% item.itemnumber | uri %]&op=slip');this.form.submit();"><i class="fa fa-print"></i> Don't check out and print slip (P)</button> > </form> > [% END %] > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt >index 42d7a19089..00818951db 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt >@@ -144,7 +144,7 @@ > <h3>Please transfer item to: [% Branches.GetName( collectionBranch ) | html %]</h3> > <p><a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&biblionumber=[% itembiblionumber | uri %]">[% itembarcode | html %]: [% title | html %]</a></p> > <p>This item is part of a rotating collection.</p> >- <p><button type="button" class="openWin" data-url="transfer-slip.pl?transferitem=[% itemnumber | html %]&branchcode=[% collectionBranch | html %]&op=slip"><i class="fa fa-print"></i> Print slip</button></p> >+ <p><button type="button" class="openWin" data-url="transfer-slip.pl?transferitem=[% itemnumber | uri %]&branchcode=[% collectionBranch | uri %]&op=slip"><i class="fa fa-print"></i> Print slip</button></p> > </div> > [% END %] > >@@ -245,7 +245,7 @@ > <!-- CONFIRM --> > <button type="button" data-dismiss="modal" class="btn btn-default approve"><i class="fa fa-check"></i> OK</button> > <!-- PRINT SLIP --> >- <button type="button" data-dismiss="modal" class="btn btn-default print openWin" data-url="transfer-slip.pl?transferitem=[% itemnumber | html %]&&branchcode=[% TransferWaitingAt | html %]&op=slip"><i class="fa fa-print"></i> Print transfer slip</button> >+ <button type="button" data-dismiss="modal" class="btn btn-default print openWin" data-url="transfer-slip.pl?transferitem=[% itemnumber | uri %]&&branchcode=[% TransferWaitingAt | uri %]&op=slip"><i class="fa fa-print"></i> Print transfer slip</button> > <!-- CANCEL TRANSFER --> > <form method="post" action="returns.pl" name="mainform"> > <button class="btn btn-default deny" type="submit"><i class="fa fa-times"></i> Cancel transfer</button> >@@ -387,11 +387,11 @@ > <div class="modal-footer"> > [% IF !transfer %] > <button type="submit" name="dotransfer" value="Yes" class="btn btn-default approve"><i class="fa fa-check"></i> Yes</button> >- <button type="submit" name="dotransfer" value="Yes" class="btn btn-default print openWin" data-url="transfer-slip.pl?transferitem=[% itemnumber | html %]&&branchcode=[% returnbranch | html %]&op=slip"><i class="fa fa-print"></i> Yes, print slip</button> >+ <button type="submit" name="dotransfer" value="Yes" class="btn btn-default print openWin" data-url="transfer-slip.pl?transferitem=[% itemnumber | uri %]&&branchcode=[% returnbranch | uri %]&op=slip"><i class="fa fa-print"></i> Yes, print slip</button> > <button type="button" data-dismiss="modal" class="btn btn-default deny" name="notransfer" value="No"><i class="fa fa-times"></i> No</button> > [% ELSE %] > <button type="button" data-dismiss="modal" class="btn btn-default approve"><i class="fa fa-check"></i> OK</button> >- <button type="button" data-dismiss="modal" name="dotransfer" class="btn btn-default print openWin" data-url="transfer-slip.pl?transferitem=[% itemnumber | html %]&branchcode=[% returnbranch | html %]&op=slip"><i class="fa fa-print"></i> Print slip</button> >+ <button type="button" data-dismiss="modal" name="dotransfer" class="btn btn-default print openWin" data-url="transfer-slip.pl?transferitem=[% itemnumber | uri %]&branchcode=[% returnbranch | uri %]&op=slip"><i class="fa fa-print"></i> Print slip</button> > [% END %] > <input type="hidden" name="return_date_override" value="[% return_date_override | html %]" /> > <input type="hidden" name="return_date_override_remember" value="[% return_date_override_remember | html %]" /> >@@ -891,11 +891,11 @@ > > $(".print-slip").on('click', function(e) { > e.preventDefault(); >- Dopop('hold-transfer-slip.pl?borrowernumber=[% patron.borrowernumber | html %]&biblionumber=[% biblionumber | html %]'); >+ Dopop('hold-transfer-slip.pl?borrowernumber=[% patron.borrowernumber | uri %]&biblionumber=[% biblionumber | uri %]'); > }); > > [% IF print_slip %] >- Dopop('hold-transfer-slip.pl?borrowernumber=[% borrowernumber | html %]&biblionumber=[% biblionumber | html %]&itemnumber=[% itemnumber | html %]'); >+ Dopop('hold-transfer-slip.pl?borrowernumber=[% borrowernumber | uri %]&biblionumber=[% biblionumber | uri %]&itemnumber=[% itemnumber | uri %]'); > [% END %] > > var columns_settings = [% ColumnsSettings.GetColumns( 'circ', 'returns', 'checkedintable', 'json' ) | $raw %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt >index 62fc2db2de..c762d9eae1 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt >@@ -65,7 +65,7 @@ > [% IF ( check_member ) %] > <div class="dialog alert"> > <h3>Duplicate patron record?</h3> >- <p><a class="popup" href="#" onclick="Dopop('moremember.pl?print=brief&borrowernumber=[% check_member | html %]');return false;" >View existing record</a></p> >+ <p><a class="popup" href="#" onclick="Dopop('moremember.pl?print=brief&borrowernumber=[% check_member | uri %]');return false;" >View existing record</a></p> > <button id="duplicate" type="submit" class="new"><i class="fa fa-pencil"></i> It is a duplicate. > Edit existing record</button> > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt >index 968770d323..2f574d945d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt >@@ -268,7 +268,7 @@ $(document).ready(function(){ > </select> > [% ELSIF ( mv.type == 'text1' ) %] > <input type="text" tabindex="1" id="[%- mv.id | html -%]" name="field_value" class="input_marceditor" size="50" maxlength="255" value="[%- mv.value | html -%]" /> >- <a href="#" class="buttonDot" onclick="Dopop('/cgi-bin/koha/authorities/auth_finder.pl?authtypecode=[%- mv.authtypecode | html -%]&index=[%- mv.id | html -%]','[%- mv.id | html -%]'); return false;" title="Tag editor">...</a> >+ <a href="#" class="buttonDot" onclick="Dopop('/cgi-bin/koha/authorities/auth_finder.pl?authtypecode=[%- mv.authtypecode | uri -%]&index=[%- mv.id | uri -%]','[%- mv.id | uri -%]'); return false;" title="Tag editor">...</a> > [% ELSIF ( mv.type == 'text2' ) %] > <input type="text" id="[%- mv.id | html -%]" name="field_value" class="input_marceditor" size="50" maxlength="255" value="[%- mv.value | html -%]" /> > [% IF mv.noclick %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt >index 8afe1b76a5..3b32371187 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt >@@ -921,7 +921,7 @@ > [% FILTER html_break %] > [% review.review | html %] > [% END %] >- <a href="#" onclick="Dopop('/cgi-bin/koha/opac-review.pl?biblionumber=[% review.biblionumber | html %]&reviewid=[% review.reviewid | html %]');">Edit</a> >+ <a href="#" onclick="Dopop('/cgi-bin/koha/opac-review.pl?biblionumber=[% review.biblionumber | uri %]&reviewid=[% review.reviewid | uri %]');">Edit</a> > </p> > </div> > [% ELSE %] >@@ -962,7 +962,7 @@ > > [% IF ( loggedinusername ) %] > [% UNLESS ( loggedincommenter ) %] >- <div id="addcomment"> <a href="#" onclick="Dopop('/cgi-bin/koha/opac-review.pl?biblionumber=[% biblio.biblionumber | html %]'); return false;"> >+ <div id="addcomment"> <a href="#" onclick="Dopop('/cgi-bin/koha/opac-review.pl?biblionumber=[% biblio.biblionumber | uri %]'); return false;"> > Post your comments on this item. > </a></div> > [% END %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-results.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-results.tt >index 12c9a2d1c6..6fa0560e26 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-results.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-results.tt >@@ -560,7 +560,7 @@ > [% END # if TagsInputEnabled %] > > [% IF ( ( Koha.Preference( 'opacuserlogin' ) == 1 ) && loggedinusername && ( Koha.Preference( 'virtualshelves' ) == 1 ) ) %] >- <span class="actions"><a class="addtoshelf" href="/cgi-bin/koha/opac-addbybiblionumber.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %]" onclick="Dopop('opac-addbybiblionumber.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %]'); return false;">Save to lists</a></span> >+ <span class="actions"><a class="addtoshelf" href="/cgi-bin/koha/opac-addbybiblionumber.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %]" onclick="Dopop('opac-addbybiblionumber.pl?biblionumber=[% SEARCH_RESULT.biblionumber | uri %]'); return false;">Save to lists</a></span> > [% END %] > > [% IF Koha.Preference( 'opacbookbag' ) == 1 %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt >index 358475e5ef..89a352ee6c 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt >@@ -467,7 +467,7 @@ > [% END # / IF TagsInputEnabled %] > > [% IF ( ( Koha.Preference( 'opacuserlogin' ) == 1 ) && loggedinusername && ( Koha.Preference( 'virtualshelves' ) == 1 ) ) %] >- <span class="actions"><a class="addtoshelf" href="/cgi-bin/koha/opac-addbybiblionumber.pl?biblionumber=[% itemsloo.biblionumber | html %]" onclick="Dopop('opac-addbybiblionumber.pl?biblionumber=[% itemsloo.biblionumber | html %]'); return false;">Save to another list</a></span> >+ <span class="actions"><a class="addtoshelf" href="/cgi-bin/koha/opac-addbybiblionumber.pl?biblionumber=[% itemsloo.biblionumber | uri %]" onclick="Dopop('opac-addbybiblionumber.pl?biblionumber=[% itemsloo.biblionumber | uri %]'); return false;">Save to another list</a></span> > [% END %] > > [% IF can_remove_biblios %] >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 23451
:
92196
|
92197
|
93219
|
93220
|
93232
|
93233
|
94414
|
94415