Bugzilla – Attachment 160761 Details for
Bug 35329
Move patron searches to a modal
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 35329: Prevent XSS
Bug-35329-Prevent-XSS.patch (text/plain), 6.39 KB, created by
Jonathan Druart
on 2024-01-10 13:13:39 UTC
(
hide
)
Description:
Bug 35329: Prevent XSS
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2024-01-10 13:13:39 UTC
Size:
6.39 KB
patch
obsolete
>From 1ff972f9b6299f11ce8537fab5c617e1e47e7c91 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Wed, 10 Jan 2024 13:56:15 +0100 >Subject: [PATCH] Bug 35329: Prevent XSS > >--- > koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc | 4 ++-- > koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt | 2 +- > .../intranet-tmpl/prog/en/modules/acqui/neworderempty.tt | 2 +- > koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt | 4 ++-- > .../intranet-tmpl/prog/en/modules/suggestion/suggestion.tt | 6 +++--- > 5 files changed, 9 insertions(+), 9 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc >index 5dfadd0c238..b766342bdb8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc >@@ -875,9 +875,9 @@ > parent_block.find(".info").hide(); > parent_block.find(".error").hide(); > if ( add_user(borrowernumber, borrowername) < 0 ) { >- parent_block.find(".error").html(_("Patron '%s' is already in the list.").format(borrowername)).show(); >+ parent_block.find(".error").html(_("Patron '%s' is already in the list.").format(borrowername.escapeHtml())).show(); > } else { >- parent_block.find(".info").html(_("Patron '%s' added.").format(borrowername)).show(); >+ parent_block.find(".info").html(_("Patron '%s' added.").format(borrowername.escapeHtml())).show(); > } > } > function modal_select_user(borrowernumber, data) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt >index a3c9fa9c88f..9e121815da7 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt >@@ -1167,7 +1167,7 @@ > if (ids.indexOf(borrowernumber.toString()) < 0) { > ids.push(borrowernumber); > $("#users_ids").val(ids.join(':')); >- var li = '<li id="user_'+borrowernumber+'">'+borrowername >+ var li = '<li id="user_'+borrowernumber+'">'+borrowername.escapeHtml() > + ' <a href="#" data-borrowernumber="'+borrowernumber+'" class="del_user"><i class="fa fa-trash-can"></i> ' > + _("Delete user") + '</a></li>'; > $("#users_names").prepend(li); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt >index ef08eb00ac7..07c2b4fb72d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt >@@ -209,7 +209,7 @@ > if (ids.indexOf(borrowernumber.toString()) < 0) { > ids.push(borrowernumber); > $("#users_ids").val(ids.join(':')); >- var li = '<li id="user_'+borrowernumber+'">'+borrowername >+ var li = '<li id="user_'+borrowernumber+'">'+borrowername.escapeHtml() > + ' [<a style="cursor:pointer" onclick="del_user('+borrowernumber+');">' > + _("Delete user") + '</a>]</li>'; > $("#users_names").append(li); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt >index 44528bddffa..2572ba3c988 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt >@@ -547,7 +547,7 @@ > if (borrowernumber) { > var ownerlink = '<a href="/cgi-bin/koha/members/moremember.pl' > + '?borrowernumber=' + borrowernumber + '">' >- + borrowername + '</a>'; >+ + borrowername.escapeHtml() + '</a>'; > $('#budget_owner_name').html(ownerlink); > $('#budget_owner_id').val(borrowernumber); > } >@@ -563,7 +563,7 @@ > if(borrowernumber && ids.indexOf(borrowernumber.toString()) == -1) { > var li = '<li id="user_' + borrowernumber + '">' > + '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=' >- + borrowernumber + '">' + borrowername + '</a> ' >+ + borrowernumber + '">' + borrowername.escapeHtml() + '</a> ' > + ' • <a data-borrowernumber="' + borrowernumber + '" class="del_user" href="#"><i class="fa fa-trash-can"></i> '+_("Remove")+'</a> ' > + '</li>'; > $("#budget_users").prepend(li); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt >index 8d657bbe9a4..d0af6e8efcf 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt >@@ -1262,7 +1262,7 @@ > if (borrowernumber) { > var managerlink = '<a href="/cgi-bin/koha/members/moremember.pl' > + '?borrowernumber=' + borrowernumber + '">' >- + borrowername + '</a>'; >+ + borrowername.escapeHtml() + '</a>'; > managedby_name.html(managerlink); > managedby.val(borrowernumber); > } >@@ -1293,9 +1293,9 @@ > success: function (data) { > var suggested = '<input type="hidden" id="suggestedby" name="suggestedby" value="' + data.borrowernumber + '" />'; > suggested += '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=' + data.borrowernumber + '">'; >- suggested += data.surname + ', ' + data.firstname + ' (' + data.cardnumber + ')'; >+ suggested += data.surname.escapeHtml() + ', ' + data.firstname.escapeHtml() + ' (' + data.cardnumber.escapeHtml() + ')'; > suggested += '</a> '; >- suggested += data._strings.library_id.str + ' (' + data._strings.category_id.str + ')'; >+ suggested += data._strings.library_id.str.escapeHtml() + ' (' + data._strings.category_id.str.escapeHtml() + ')'; > $("#tdsuggestedby").html(suggested); > > }, >-- >2.34.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 35329
:
160698
|
160699
|
160700
|
160701
|
160702
|
160703
|
160704
|
160705
|
160706
|
160728
|
160729
|
160733
|
160734
|
160735
|
160736
|
160737
|
160738
|
160739
|
160740
|
160741
|
160742
|
160743
|
160759
|
160760
|
160761
|
160762
|
160763
|
160768
|
160769
|
160770
|
160771
|
160773
|
160774
|
160940
|
160941
|
160943
|
160944
|
160945
|
160946
|
160947
|
160948
|
160949
|
160950
|
160951
|
160952
|
160953
|
160954
|
160955
|
160956
|
160957
|
160958
|
160959
|
161165
|
161166
|
161183
|
161184
|
161185
|
161186
|
161187
|
161188
|
161189
|
161190
|
161191
|
161192
|
161193
|
161194
|
161195
|
161196
|
161197
|
161198
|
161199
|
161259
|
161260
|
161274
|
161275
|
161276
|
161277
|
161278
|
161279
|
161280
|
161281
|
161282
|
161283
|
161284
|
161285
|
161286
|
161287
|
161288
|
161289
|
161290
|
161291
|
161292
|
161293
|
161294
|
161295
|
161398
|
161399
|
161400
|
161401
|
161402
|
161403
|
161404
|
161405
|
161406
|
161407
|
161408
|
161409
|
161410
|
161411
|
161412
|
161413
|
161414
|
161415
|
161416
|
161417
|
162436
|
162437
|
162438
|
162439
|
162440
|
162441
|
162442
|
162443
|
162444
|
162445
|
162446
|
162447
|
162448
|
162449
|
162450
|
162451
|
162452
|
162453
|
162454
|
162455
|
162456
|
162457
|
162670
|
162671
|
162713
|
162714