Attachment 108715 Details for Bug 22343 – Bug 22343: having fun with uri components

[patch] Bug 22343: having fun with uri components

Bug-22343-having-fun-with-uri-components.patch (text/plain), 2.77 KB, created by Jonathan Druart on 2020-08-20 09:32:20 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2020-08-20 09:32:20 UTC

Size: 2.77 KB

patch

obsolete

>From 86a4c60ed93ed41815fc6d1f0d0709d85a7a4189 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Thu, 20 Aug 2020 10:51:20 +0200
>Subject: [PATCH] Bug 22343: having fun with uri components
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Test with name=<script>alert("â¤");</script>
>---
> .../intranet-tmpl/prog/en/modules/admin/smtp_servers.tt     | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt
>index 1012c31831..ee1faab2e2 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt
>@@ -373,7 +373,7 @@
>                     {
>                         "data": function( row, type, val, meta ) {
>                             var result = '<a class="btn btn-default btn-xs" role="button" href="/cgi-bin/koha/admin/smtp_servers.pl?op=edit_form&amp;smtp_server_id='+ encodeURIComponent(row.smtp_server_id) +'"><i class="fa fa-pencil" aria-hidden="true"></i> '+_("Edit")+'</a>'+"\n";
>-                            result += '<a class="btn btn-default btn-xs delete_server" role="button" href="#" data-toggle="modal" data-target="#delete_confirm_modal" data-smtp-server-id="'+ encodeURIComponent(row.smtp_server_id) +'" data-smtp-server-name="'+ encodeURIComponent(row.name) +'"><i class="fa fa-trash" aria-hidden="true"></i>'+_("Delete")+'</a>';
>+                            result += '<a class="btn btn-default btn-xs delete_server" role="button" href="#" data-toggle="modal" data-target="#delete_confirm_modal" data-smtp-server-id="'+ encodeURIComponent(row.smtp_server_id) +'" data-smtp-server-name="'+ encodeURIComponent(row.name.escapeHtml()) +'"><i class="fa fa-trash" aria-hidden="true"></i>'+_("Delete")+'</a>';
>                             return result;
>                         },
>                         "searchable": false,
>@@ -387,9 +387,9 @@
>                 var smtp_server_name = $(this).data('smtp-server-name');
> 
>                 $("#delete_confirm_dialog").html(
>-                    _("You are about to delete the \"%s\" SMTP server.").format(smtp_server_name)
>+                    _("You are about to delete the \"%s\" SMTP server.").format(decodeURIComponent(smtp_server_name))
>                 );
>-                $("#delete_confirm_modal_button").attr("href", "/cgi-bin/koha/admin/smtp_servers.pl?op=delete&amp;smtp_server_id=" + encodeURIComponent(smtp_server_id));
>+                $("#delete_confirm_modal_button").attr("href", "/cgi-bin/koha/admin/smtp_servers.pl?op=delete&amp;smtp_server_id=" + decodeURIComponent(smtp_server_id));
>             });
>         });
>     </script>
>-- 
>2.20.1

Actions: View | Diff | Splinter Review

Attachments on bug 22343: 107598 | 107599 | 107600 | 107601 | 107602 | 107603 | 107604 | 107605 | 107987 | 107988 | 107989 | 107990 | 107991 | 107992 | 107993 | 107994 | 107995 | 107996 | 107997 | 107998 | 107999 | 108009 | 108107 | 108108 | 108109 | 108110 | 108111 | 108112 | 108113 | 108114 | 108115 | 108116 | 108117 | 108118 | 108119 | 108131 | 108132 | 108133 | 108134 | 108135 | 108136 | 108137 | 108138 | 108139 | 108140 | 108141 | 108142 | 108143 | 108529 | 108537 | 108538 | 108539 | 108540 | 108541 | 108542 | 108543 | 108544 | 108545 | 108546 | 108547 | 108548 | 108549 | 108609 | 108638 | 108642 | 108643 | 108644 | 108645 | 108646 | 108647 | 108648 | 108649 | 108650 | 108651 | 108652 | 108653 | 108654 | 108655 | 108656 | 108715 | 108716 | 109003 | 109004 | 109005 | 109006 | 109007 | 109008 | 109009 | 109010 | 109011 | 109012 | 109013 | 109014 | 109015 | 109016 | 109017 | 109018 | 109155 | 109156 | 109157 | 109158 | 109159 | 109160 | 109161 | 109162 | 109163 | 109164 | 109165 | 109166 | 109167 | 109168 | 109169 | 109170 | 109601 | 109602 | 109603 | 109604 | 109605 | 109606 | 109607 | 109608 | 109609 | 109610 | 109611 | 109612 | 109613 | 109614 | 109615 | 109616 | 109723 | 109724 | 109725 | 109726 | 109727 | 109728 | 109729 | 109730 | 109731 | 109732 | 109733 | 109734 | 109735 | 109736 | 109737 | 109738 | 109739 | 109740 | 109787 | 109788 | 111048 | 111087 | 111088 | 111089 | 111090 | 111154 | 111165 | 111166 | 111175 | 111176 | 111213 | 111215 | 111216 | 111442 | 111482 | 113240 | 113827 | 113847