Attachment 114942 Details for Bug 20212 – Bug 20212: (QA follow-up) Fix escaping

[patch] Bug 20212: (QA follow-up) Fix escaping

Bug-20212-QA-follow-up-Fix-escaping.patch (text/plain), 3.55 KB, created by Tomás Cohen Arazi (tcohen) on 2021-01-07 19:46:01 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomás Cohen Arazi (tcohen)

Created: 2021-01-07 19:46:01 UTC

Size: 3.55 KB

patch

obsolete

>From 77b3323d7c51be3fd47552cc8fe6d7d9e4b79a82 Mon Sep 17 00:00:00 2001
>From: Tomas Cohen Arazi <tomascohen@theke.io>
>Date: Thu, 7 Jan 2021 16:45:36 -0300
>Subject: [PATCH] Bug 20212: (QA follow-up) Fix escaping
>
>Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
>---
> .../intranet-tmpl/prog/en/modules/acqui/parcel.tt    | 12 ++++++------
> 1 file changed, 6 insertions(+), 6 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt
>index 56fd4c7aeb..ec074c2cc4 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt
>@@ -560,7 +560,7 @@
>                       "orderable": true,
>                       "render": function(data, type, row, meta) {
>                         if (type != 'display') return data;
>-                        return "<a href=\"/cgi-bin/koha/acqui/basket.pl?basketno=" + row.basket.basket_id + "\">" + data + " (" + row.basket.basket_id + ")</a>";
>+                        return "<a href=\"/cgi-bin/koha/acqui/basket.pl?basketno=" + encodeURIComponent(row.basket.basket_id) + "\">" + data.escapeHtml() + " (" + row.basket.basket_id.escapeHtml() + ")</a>";
>                       }
>                     },
>                     { "data": "basket.basket_group.name",
>@@ -579,9 +579,9 @@
>                         }
>                         else {
>                             return "<a href=\"/cgi-bin/koha/acqui/basketgroup.pl?op=add&amp;booksellerid="
>-                                    + row.basket.vendor_id + "&amp;basketgroupid="
>-                                    + row.basket.basket_group_id + "\">"
>-                                    + row.basket.basket_group.name + " (" + row.basket.basket_group_id + ")</a>";
>+                                    + encodeURIComponent(row.basket.vendor_id) + "&amp;basketgroupid="
>+                                    + encodeURIComponent(row.basket.basket_group_id) + "\">"
>+                                    + row.basket.basket_group.name.escapeHtml() + " (" + row.basket.basket_group_id.escapeHtml() + ")</a>";
>                         }
>                       }
>                     },
>@@ -589,7 +589,7 @@
>                         "data": "order_id",
>                         "render": function(data, type, row, meta) {
>                             if (type != 'display') return data;
>-                            return "<a href=\"neworderempty.pl?ordernumber="+data+"&amp;booksellerid="+row.basket.vendor_id+"\">"+data+"</a>";
>+                            return "<a href=\"neworderempty.pl?ordernumber="+encodeURIComponent(data)+"&amp;booksellerid="+encodeURIComponent(row.basket.vendor_id)+"\">"+data.escapeHtml()+"</a>";
>                         }
>                     },
>                     {
>@@ -646,7 +646,7 @@
>                                                             + encodeURIComponent(suggestion.suggestionid)
>                                                             + '&amp;op=show">'
>                                                             + suggested_by.join(", ")
>-                                                            + " (#" + suggestions[0].suggestionid + ")</a>"; // FIXME: could be changed if we allow matching multiple suggestions
>+                                                            + " (#" + suggestions[0].suggestionid.escapeHtml() + ")</a>"; // FIXME: could be changed if we allow matching multiple suggestions
>                                     }
>                                 }
>                                 result += '</p>';
>-- 
>2.30.0

Actions: View | Diff | Splinter Review

Attachments on bug 20212: 97545 | 97546 | 97547 | 97629 | 97630 | 97633 | 97634 | 97635 | 97745 | 98226 | 98230 | 98241 | 99724 | 99725 | 99727 | 100142 | 100475 | 100476 | 100477 | 100478 | 100552 | 100553 | 100554 | 100555 | 100600 | 100601 | 100602 | 100603 | 100605 | 100606 | 100643 | 101320 | 103684 | 103685 | 103686 | 103687 | 103688 | 109861 | 109862 | 109863 | 109864 | 109866 | 109867 | 109868 | 109869 | 109870 | 109936 | 110229 | 110234 | 110478 | 110482 | 111568 | 111569 | 112310 | 112521 | 112522 | 112523 | 112524 | 112686 | 112695 | 112698 | 112699 | 112700 | 112702 | 112703 | 112704 | 112705 | 112706 | 112868 | 112882 | 112987 | 113278 | 113279 | 114607 | 114608 | 114609 | 114610 | 114611 | 114612 | 114613 | 114614 | 114615 | 114616 | 114617 | 114942 | 114953 | 114954 | 114956 | 114959 | 114963 | 115050 | 115056 | 115057 | 115060 | 115062 | 115107 | 115108 | 115109 | 115817 | 115818 | 115819 | 115820 | 115821 | 115822 | 115886 | 115887 | 115888 | 115889 | 115890 | 115891 | 115892 | 115893 | 115894 | 115895 | 115896 | 115897 | 115898 | 115899 | 115900 | 115901 | 115902 | 115903 | 115904 | 115905 | 115906 | 115920 | 115921 | 115940 | 115941 | 115943 | 115944 | 115945 | 115946 | 115947 | 115948 | 115949 | 115950 | 115951 | 115952 | 115953 | 115954 | 115955 | 115956 | 115957 | 115958 | 115959 | 115960 | 115961 | 115962 | 115963 | 115964 | 115965 | 116139