Attachment #127062 for bug #28959

View | Details | Raw Unified | Return to bug 28959
Collapse All | Expand All




                        <li class="breadcrumb-item"><a href="/cgi-bin/koha/opac-user.pl">[% INCLUDE 'patron-title.inc' patron = logged_in_user %]</a></li>
                    [% END %]
                    <li class="breadcrumb-item">
                        [% IF shelf.public %]
                            <a href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;public=0">Your lists</a>
                        [% ELSE %]
                            <a href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;public=1">Public lists</a>
                        [% ELSE %]
                            <a href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;public=0">Your lists</a>
                        [% END %]
                    </li>
                    <li class="breadcrumb-item active">




    $shelf = Koha::Virtualshelves->find( $shelfnumber ) unless $param->{errcode};
    $param->{shelfname} = $shelf ? $shelf->shelfname : q||;
    $param->{owner}     = $shelf ? $shelf->owner : -1;
    $param->{public}    = $shelf ? $shelf->public : 0;

    load_template($param);
    return $param;

    # You must not be the owner and the list must be private
    if( !$shelf ) {
        $param->{errcode} = 2;
    } elsif( $shelf->public ) {
        $param->{errcode} = 5;
    } elsif( $shelf->owner == $param->{loggedinuser} ) {
        $param->{errcode} = 8;

    #sharing user should be the owner
    #list should be private
    $param->{errcode} = 4 if $param->{owner} != $param->{loggedinuser};
    $param->{errcode} = 5 if !$param->{errcode} && $param->{public};
    return !defined $param->{errcode};
}





            {
                class => 'Koha::Virtualshelves',
                value => {
                    public                   => 1,
                    allow_change_from_owner  => 1,
                    allow_change_from_others => 0,
                    owner                    => $patron->borrowernumber

    $patron->set_password({ password => $password });
    $s->opac_auth( $patron->userid, $password );

    my $public_lists = $s->opac_base_url . q|opac-shelves.pl?op=list&public=1|;
    $driver->get($public_lists);

    $s->remove_error_handler;

    is( $alert_text, undef, 'No alert box displayed' );

    my $booh_alert = 'booh!';
    $public_lists = $s->opac_base_url . qq|opac-shelves.pl?op=list&public=1"><script>alert('$booh_alert')</script>|;
    $driver->get($public_lists);

    $s->remove_error_handler;

    is( $alert_text, undef, 'No alert box displayed, even if evil intent' );

    my $second_page = $driver->find_element('//div[@class="pages"]/span[@class="currentPage"]/following-sibling::a');
    like( $second_page->get_attribute('href'), qr{(?|&)public=1(&|$)}, 'The second page should display category without the invalid value' );

    push @cleanup, $patron, $patron->category, $patron->library;





    if this parameter exists, then it must be equals to the name of the shelf
    to add.

=item public

    if this script has to add a shelf, it adds one with this 'public' setting.

=item newshelf


my $shelfnumber     = $query->param('shelfnumber');
my $newvirtualshelf = $query->param('newvirtualshelf');
my $newshelf        = $query->param('newshelf');
my $public          = $query->param('public');
my $sortfield       = $query->param('sortfield');
my $confirmed       = $query->param('confirmed') || 0;
my ( $errcode, $authorized ) = ( 0, 1 );

        Koha::Virtualshelf->new(
            {
                shelfname => $newvirtualshelf,
                public    => $public,
                sortfield => $sortfield,
                owner     => $loggedinuser,
            }


} else {
    my $private_shelves = Koha::Virtualshelves->search(
        {   public                  => 0,
            owner                   => $loggedinuser,
            allow_change_from_owner => 1,
        },
        { order_by => 'shelfname' }
    );
    my $shelves_shared_with_me = Koha::Virtualshelves->search(
        {   public                              => 0,
            'virtualshelfshares.borrowernumber' => $loggedinuser,
            allow_change_from_others            => 1,
        },
        { join => 'virtualshelfshares', }
    );
    my $public_shelves = Koha::Virtualshelves->search(
        {   public   => 1,
            -or      => [
                -and => {
                    allow_change_from_owner => 1,
- 

Return to bug 28959

Lines 16-25 Link Here

(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt (-3 / +3 lines)
16	<li class="breadcrumb-item"><a href="/cgi-bin/koha/opac-user.pl">[% INCLUDE 'patron-title.inc' patron = logged_in_user %]</a></li>	16	<li class="breadcrumb-item"><a href="/cgi-bin/koha/opac-user.pl">[% INCLUDE 'patron-title.inc' patron = logged_in_user %]</a></li>
17	[% END %]	17	[% END %]
18	<li class="breadcrumb-item">	18	<li class="breadcrumb-item">
19	[% IF shelf.category == 1 %]	19	[% IF shelf.public %]
20	<a href="/cgi-bin/koha/opac-shelves.pl?op=list&public=0">Your lists</a>
21	[% ELSE %]
22	<a href="/cgi-bin/koha/opac-shelves.pl?op=list&public=1">Public lists</a>	20	<a href="/cgi-bin/koha/opac-shelves.pl?op=list&public=1">Public lists</a>
		21	[% ELSE %]
		22	<a href="/cgi-bin/koha/opac-shelves.pl?op=list&public=0">Your lists</a>
23	[% END %]	23	[% END %]
24	</li>	24	</li>
25	<li class="breadcrumb-item active">	25	<li class="breadcrumb-item active">

Lines 81-87 sub _init { Link Here

(-)a/opac/opac-shareshelf.pl (-3 / +3 lines)
81	$shelf = Koha::Virtualshelves->find( $shelfnumber ) unless $param->{errcode};	81	$shelf = Koha::Virtualshelves->find( $shelfnumber ) unless $param->{errcode};
82	$param->{shelfname} = $shelf ? $shelf->shelfname : q\|\|;	82	$param->{shelfname} = $shelf ? $shelf->shelfname : q\|\|;
83	$param->{owner} = $shelf ? $shelf->owner : -1;	83	$param->{owner} = $shelf ? $shelf->owner : -1;
84	$param->{category} = $shelf ? $shelf->category : -1;	84	$param->{public} = $shelf ? $shelf->public : 0;
85		85
86	load_template($param);	86	load_template($param);
87	return $param;	87	return $param;
Lines 128-134 sub show_accept { Link Here
128	# You must not be the owner and the list must be private	128	# You must not be the owner and the list must be private
129	if( !$shelf ) {	129	if( !$shelf ) {
130	$param->{errcode} = 2;	130	$param->{errcode} = 2;
131	} elsif( $shelf->category == 2 ) {	131	} elsif( $shelf->public ) {
132	$param->{errcode} = 5;	132	$param->{errcode} = 5;
133	} elsif( $shelf->owner == $param->{loggedinuser} ) {	133	} elsif( $shelf->owner == $param->{loggedinuser} ) {
134	$param->{errcode} = 8;	134	$param->{errcode} = 8;
Lines 264-270 sub check_owner_category { Link Here
264	#sharing user should be the owner	264	#sharing user should be the owner
265	#list should be private	265	#list should be private
266	$param->{errcode} = 4 if $param->{owner} != $param->{loggedinuser};	266	$param->{errcode} = 4 if $param->{owner} != $param->{loggedinuser};
267	$param->{errcode} = 5 if !$param->{errcode} && $param->{category} != 1;	267	$param->{errcode} = 5 if !$param->{errcode} && $param->{public};
268	return !defined $param->{errcode};	268	return !defined $param->{errcode};
269	}	269	}
270		270

Lines 179-185 subtest 'XSS vulnerabilities in pagination' => sub { Link Here

(-)a/t/db_dependent/selenium/regressions.t (-4 / +4 lines)
179	{	179	{
180	class => 'Koha::Virtualshelves',	180	class => 'Koha::Virtualshelves',
181	value => {	181	value => {
182	category => 2,	182	public => 1,
183	allow_change_from_owner => 1,	183	allow_change_from_owner => 1,
184	allow_change_from_others => 0,	184	allow_change_from_others => 0,
185	owner => $patron->borrowernumber	185	owner => $patron->borrowernumber
Lines 193-199 subtest 'XSS vulnerabilities in pagination' => sub { Link Here
193	$patron->set_password({ password => $password });	193	$patron->set_password({ password => $password });
194	$s->opac_auth( $patron->userid, $password );	194	$s->opac_auth( $patron->userid, $password );
195		195
196	my $public_lists = $s->opac_base_url . q\|opac-shelves.pl?op=list&category=2\|;	196	my $public_lists = $s->opac_base_url . q\|opac-shelves.pl?op=list&public=1\|;
197	$driver->get($public_lists);	197	$driver->get($public_lists);
198		198
199	$s->remove_error_handler;	199	$s->remove_error_handler;
Lines 202-208 subtest 'XSS vulnerabilities in pagination' => sub { Link Here
202	is( $alert_text, undef, 'No alert box displayed' );	202	is( $alert_text, undef, 'No alert box displayed' );
203		203
204	my $booh_alert = 'booh!';	204	my $booh_alert = 'booh!';
205	$public_lists = $s->opac_base_url . qq\|opac-shelves.pl?op=list&category=2"><script>alert('$booh_alert')</script>\|;	205	$public_lists = $s->opac_base_url . qq\|opac-shelves.pl?op=list&public=1"><script>alert('$booh_alert')</script>\|;
206	$driver->get($public_lists);	206	$driver->get($public_lists);
207		207
208	$s->remove_error_handler;	208	$s->remove_error_handler;
Lines 211-217 subtest 'XSS vulnerabilities in pagination' => sub { Link Here
211	is( $alert_text, undef, 'No alert box displayed, even if evil intent' );	211	is( $alert_text, undef, 'No alert box displayed, even if evil intent' );
212		212
213	my $second_page = $driver->find_element('//div[@class="pages"]/span[@class="currentPage"]/following-sibling::a');	213	my $second_page = $driver->find_element('//div[@class="pages"]/span[@class="currentPage"]/following-sibling::a');
214	like( $second_page->get_attribute('href'), qr{(?\|&)category=2(&\|$)}, 'The second page should display category without the invalid value' );	214	like( $second_page->get_attribute('href'), qr{(?\|&)public=1(&\|$)}, 'The second page should display category without the invalid value' );
215		215
216	push @cleanup, $patron, $patron->category, $patron->library;	216	push @cleanup, $patron, $patron->category, $patron->library;
217		217

Lines 44-52 addbybiblionumber.pl Link Here

(-)a/virtualshelves/addbybiblionumber.pl (-9 / +8 lines)
44	if this parameter exists, then it must be equals to the name of the shelf	44	if this parameter exists, then it must be equals to the name of the shelf
45	to add.	45	to add.
46		46
47	=item category	47	=item public
48		48
49	if this script has to add a shelf, it add one with this category.	49	if this script has to add a shelf, it adds one with this 'public' setting.
50		50
51	=item newshelf	51	=item newshelf
52		52
Lines 69-75 my $query = CGI->new; Link Here
69	my $shelfnumber = $query->param('shelfnumber');	69	my $shelfnumber = $query->param('shelfnumber');
70	my $newvirtualshelf = $query->param('newvirtualshelf');	70	my $newvirtualshelf = $query->param('newvirtualshelf');
71	my $newshelf = $query->param('newshelf');	71	my $newshelf = $query->param('newshelf');
72	my $category = $query->param('category');	72	my $public = $query->param('public');
73	my $sortfield = $query->param('sortfield');	73	my $sortfield = $query->param('sortfield');
74	my $confirmed = $query->param('confirmed') \|\| 0;	74	my $confirmed = $query->param('confirmed') \|\| 0;
75	my ( $errcode, $authorized ) = ( 0, 1 );	75	my ( $errcode, $authorized ) = ( 0, 1 );
Lines 95-101 if ($newvirtualshelf) { Link Here
95	Koha::Virtualshelf->new(	95	Koha::Virtualshelf->new(
96	{	96	{
97	shelfname => $newvirtualshelf,	97	shelfname => $newvirtualshelf,
98	category => $category,	98	public => $public,
99	sortfield => $sortfield,	99	sortfield => $sortfield,
100	owner => $loggedinuser,	100	owner => $loggedinuser,
101	}	101	}
Lines 149-169 if ($newvirtualshelf) { Link Here
149		149
150	} else {	150	} else {
151	my $private_shelves = Koha::Virtualshelves->search(	151	my $private_shelves = Koha::Virtualshelves->search(
152	{ category => 1,	152	{ public => 0,
153	owner => $loggedinuser,	153	owner => $loggedinuser,
154	allow_change_from_owner => 1,	154	allow_change_from_owner => 1,
155	},	155	},
156	{ order_by => 'shelfname' }	156	{ order_by => 'shelfname' }
157	);	157	);
158	my $shelves_shared_with_me = Koha::Virtualshelves->search(	158	my $shelves_shared_with_me = Koha::Virtualshelves->search(
159	{ category => 1,	159	{ public => 0,
160	'virtualshelfshares.borrowernumber' => $loggedinuser,	160	'virtualshelfshares.borrowernumber' => $loggedinuser,
161	allow_change_from_others => 1,	161	allow_change_from_others => 1,
162	},	162	},
163	{ join => 'virtualshelfshares', }	163	{ join => 'virtualshelfshares', }
164	);	164	);
165	my $public_shelves = Koha::Virtualshelves->search(	165	my $public_shelves = Koha::Virtualshelves->search(
166	{ category => 2,	166	{ public => 1,
167	-or => [	167	-or => [
168	-and => {	168	-and => {
169	allow_change_from_owner => 1,	169	allow_change_from_owner => 1,
170	-