Attachment 149489 Details for Bug 33103 – Bug 33103: Deal with html tags

[patch] Bug 33103: Deal with html tags

Bug-33103-Deal-with-html-tags.patch (text/plain), 2.01 KB, created by Katrin Fischer on 2023-04-11 21:01:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Katrin Fischer

Created: 2023-04-11 21:01:25 UTC

Size: 2.01 KB

patch

obsolete

>From d208e9fed8a374a8a590c553ece49f29966c1ceb Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Tue, 7 Mar 2023 12:54:31 +0100
>Subject: [PATCH] Bug 33103: Deal with html tags
>
>HTML tags won't be interpreted. However <script> will still break the
>display, but it's by nature, JS will execute it even if it's in a
>string.
>---
> .../prog/en/modules/acqui/supplier.tt         | 19 +++++++++++++++++--
> 1 file changed, 17 insertions(+), 2 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt
>index ad73ec84bb..8a03894351 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt
>@@ -477,6 +477,18 @@
>             aliases.splice(i, 1);
>             refresh_aliases();
>         }
>+
>+        function encodeHTMLEntities(str){
>+            return str.replace(/[&<>'"]/g,
>+              tag => ({
>+                  '&': '&amp;',
>+                  '<': '&lt;',
>+                  '>': '&gt;',
>+                  "'": '&#39;',
>+                  '"': '&quot;'
>+                }[tag]));
>+        }
>+
>         function add_alias(){
>             let alias = $("#new_alias").val();
>             if ( !alias.length > 0 ) { return }
>@@ -486,8 +498,11 @@
>         function refresh_aliases(){
>             let nodes = $("<div></div>");
>             aliases.forEach((a, i) => {
>-                let n = $("<div></div>").append(a.alias);
>-                n.append(`<input type="hidden" name="alias" value="${a.alias}">`)
>+                let alias_str = encodeHTMLEntities(a.alias);
>+                let n = $("<div></div>").append(alias_str);
>+                let input = $('<input type="hidden" name="alias" />');
>+                input.val(a.alias);
>+                n.append(input);
>                 n.append(`<a onclick="remove_alias(${i});"><i class="fa fa-trash" aria-hidden="true"></i></a>`);
>                 nodes.append(n);
>             });
>-- 
>2.30.2

Actions: View | Diff | Splinter Review

Attachments on bug 33103: 147621 | 147622 | 147623 | 147624 | 147625 | 147626 | 147627 | 147628 | 147629 | 147630 | 147645 | 147646 | 147647 | 147648 | 147649 | 147650 | 147651 | 147652 | 147653 | 147654 | 147827 | 148448 | 148449 | 148450 | 148451 | 148452 | 148453 | 148454 | 148455 | 148456 | 148457 | 148458 | 149414 | 149419 | 149479 | 149480 | 149481 | 149482 | 149483 | 149484 | 149485 | 149486 | 149487 | 149488 | 149489 | 149490 | 149491 | 149606 | 149607 | 149608 | 149609 | 149629 | 149630 | 149788