Attachment 164334 Details for Bug 33568 – Bug 33568: Escape all the things

[patch] Bug 33568: Escape all the things

Bug-33568-Escape-all-the-things.patch (text/plain), 16.11 KB, created by Jonathan Druart on 2024-04-03 07:39:17 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2024-04-03 07:39:17 UTC

Size: 16.11 KB

patch

obsolete

>From 25c877c4063d60a0a8e2f78c4b8a0aca3e10a886 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Thu, 20 Apr 2023 10:19:02 +0200
>Subject: [PATCH] Bug 33568: Escape all the things
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Signed-off-by: Owen Leonard <oleonard@myacpl.org>
>
>Signed-off-by: Laurence Rault <laurence.rault@biblibre.com>
>Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
>Signed-off-by: TomÃ¡s Cohen Arazi <tomascohen@theke.io>
>---
> .../prog/en/modules/catalogue/detail.tt | 66 +++++++++----------
> 1 file changed, 33 insertions(+), 33 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt
>index bff8e66ac2e..22375e56123 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt
>@@ -2253,10 +2253,10 @@
> let image_location = item_type_image_locations[row.item_type_id];
> let item_type_description = row._strings.item_type_id.str;
> node += image_location
>- ? '<img src="%s" alt="%s" title="%s" /> '.format(image_location, item_type_description, item_type_description)
>+ ? '<img src="%s" alt="%s" title="%s" /> '.format(escape_str(image_location), escape_str(item_type_description), escape_str(item_type_description))
> : '';
> [% END %]
>- node += '%s'.format(item_type_description);
>+ node += '%s'.format(escape_str(item_type_description));
> return node;
> }
> },
>@@ -2267,7 +2267,7 @@
> searchable: true,
> orderable: true,
> render: function (data, type, row, meta) {
>- return row._strings.holding_library_id.str;
>+ return escape_str(row._strings.holding_library_id.str);
> }
> },
> {
>@@ -2276,7 +2276,7 @@
> searchable: true,
> orderable: true,
> render: function (data, type, row, meta) {
>- let nodes = '%s'.format(row._strings.home_library_id.str);
>+ let nodes = '%s'.format(escape_str(row._strings.home_library_id.str));
> nodes += ''
> [%# If permanent location is defined, show description or code and %]
> [%# display current location in parentheses. If not, display current location. %]
>@@ -2284,9 +2284,9 @@
> let loc_str = row._strings.location.str;
> if ( row.permanent_location && row.permanent_location != row.location ) {
> let permanent_loc_str = av_loc[row.permanent_location];
>- nodes += '%s (%s)'.format(permanent_loc_str, loc_str);
>+ nodes += '%s (%s)'.format(escape_str(permanent_loc_str), escape_str(loc_str));
> } else {
>- nodes += loc_str;
>+ nodes += escape_str(loc_str);
> }
> nodes += '';
> return nodes;
>@@ -2297,7 +2297,7 @@
> searchable: true,
> orderable: true,
> render: function (data, type, row, meta) {
>- return row._strings.collection_code.str;
>+ return escape_str(row._strings.collection_code.str);
> }
> },
> [% IF Koha.Preference('EnableItemGroups') %]
>@@ -2308,7 +2308,7 @@
> orderable: true,
> render: function (data, type, row, meta) {
> if ( row.item_group_item ) {
>- return row.item_group_item.item_group.description;
>+ return escape_str(row.item_group_item.item_group.description);
> } else {
> return "";
> }
>@@ -2321,7 +2321,7 @@
> searchable: true,
> orderable: true,
> render: function (data, type, row, meta) {
>- return row.callnumber;
>+ return escape_str(row.callnumber);
> }
> 
> },
>@@ -2335,15 +2335,15 @@
> [%# FIXME Previously we displayed the column if at least one item of the biblio had an enumchron/serial_issue_number. Now it's only if one item of the ones displayed on the current page, how is that bad? How can it be fixed in an elegant way? Should we display the column only if biblio.serial? %]
> let serial = row.serialitem ? row.serialitem.serial : null;
> if ( row.serial_issue_number && serial && serial.serialseq ) {
>- nodes += '%s'.format(row.serial_issue_number);
>+ nodes += '%s'.format(escape_str(row.serial_issue_number));
> if ( serial.serialseq && row.serial_issue_number != serial.serialseq ) {
> nodes += ' -- '
>- nodes += ' %s'.format(serial.serialseq);
>+ nodes += ' %s'.format(escape_str(serial.serialseq));
> }
> } else if ( row.serial_issue_number ) {
>- nodes += ' %s'.format(row.serial_issue_number);
>+ nodes += ' %s'.format(escape_str(row.serial_issue_number));
> } else if ( serial && serial.serialseq ) {
>- nodes += '%s'.format(serial.serialseq);
>+ nodes += '%s'.format(escape_str(serial.serialseq));
> }
> if ( serial && serial.publisheddate ) {
> nodes += ' (%s)'.format($date(serial.publisheddate));
>@@ -2373,30 +2373,30 @@
> nodes += ""
> } else if ( row.transfer ) {
> if ( row.transfer.datesent ) {
>- nodes += '%s'.format(_("In transit from %s to %s since %s").format(row.transfer.frombranch, row.transfer.tobranch, $date(row.transfer.datesent))); [%# FIXME display library names, not codes, do we use _strings here? %]
>+ nodes += '%s'.format(_("In transit from %s to %s since %s").format(escape_str(row.transfer.frombranch), escape_str(row.transfer.tobranch), $date(row.transfer.datesent))); [%# FIXME display library names, not codes, do we use _strings here? %]
> } else {
>- nodes += '%s'.format(_("Transit pending from %s to %s since %s").format(row.transfer.frombranch, row.transfer.tobranch, $date(row.transfer.daterequested))); [%# FIXME See above %]
>+ nodes += '%s'.format(_("Transit pending from %s to %s since %s").format(escape_str(row.transfer.frombranch), escape_str(row.transfer.tobranch), $date(row.transfer.daterequested))); [%# FIXME See above %]
> }
> }
> 
> if ( row.lost_status ) {
> let lost_lib = av_lost.get(row.lost_status.toString()) || _("Unavailable (lost or missing");
>- nodes += '%s'.format(lost_lib);
>+ nodes += '%s'.format(escape_str(lost_lib));
> }
> 
> if ( row.withdrawn ) {
> let withdrawn_lib = av_withdrawn.get(row.withdrawn.toString()) || _("Withdrawn");
>- nodes += '%s'.format(withdrawn_lib);
>+ nodes += '%s'.format(escape_str(withdrawn_lib));
> }
> 
> if ( row.damaged ) {
> let damaged_lib = av_damaged.get(row.damaged.toString()) || _("Damaged");
>- nodes += '%s'.format(damaged_lib);
>+ nodes += '%s'.format(escape_str(damaged_lib));
> }
> 
> if ( row.not_for_loan_status || row.item_type.notforloan ) {
> let not_for_loan_lib = av_not_for_loan.get(row.not_for_loan_status.toString());
>- nodes += '%s'.format(_("Not for loan")) + ( not_for_loan_lib ? ' (%s)'.format(not_for_loan_lib) : '' ) + '';
>+ nodes += '%s'.format(_("Not for loan")) + ( not_for_loan_lib ? ' (%s)'.format(escape_str(not_for_loan_lib)) : '' ) + '';
> }
> 
> if ( row.first_hold ) {
>@@ -2418,10 +2418,10 @@
> [% IF Koha.Preference('UseRecalls') %]
> if ( row.recall ) {
> if ( row.recall.waiting_date ) {
>- nodes += '%s'.format(_("Waiting at %s since %s").format(row.recall.pickup_library_id, $date(row.recall.waiting_date))); # FIXME Display library names instead of codes
>+ nodes += '%s'.format(_("Waiting at %s since %s").format(escape_str(row.recall.pickup_library_id), $date(row.recall.waiting_date))); # FIXME Display library names instead of codes
> } else {
> let patron_to_html = $patron_to_html(row.recall.patron);
>- nodes += '%s'.format(_("recalled by %s on %s").format(patron_to_html, row.recall.created_date))
>+ nodes += '%s'.format(_("recalled by %s on %s").format(patron_to_html, $date(row.recall.created_date)))
> }
> }
> [% END %]
>@@ -2431,7 +2431,7 @@
> }
> 
> if ( row.restricted_status ) {
>- nodes += '(%s)'.format(av_restricted.get(row.restricted_status.toString()));
>+ nodes += '(%s)'.format(escape_str(av_restricted.get(row.restricted_status.toString())));
> }
> 
> if ( row.in_bundle ) {
>@@ -2505,10 +2505,10 @@
> let nodes = '';
> if ( row.uri.split(' \| ').length > 1 ) {
> row.uri.split(' \| ').forEach((uri, i) => {
>- nodes += '<a href="%s">%s</a> '.format(uri, uri);
>+ nodes += '<a href="%s">%s</a> '.format(escape_str(uri), escape_str(uri));
> });
> } else {
>- nodes += '<a href="%s">%s</a> '.format(row.uri, url_link_text);
>+ nodes += '<a href="%s">%s</a> '.format(escape_str(row.uri), escape_str(url_link_text));
> }
> return nodes;
> }
>@@ -2519,7 +2519,7 @@
> searchable: true,
> orderable: true,
> render: function (data, type, row, meta) {
>- return row._strings.copy_number ? row._strings.copy_number.str : row.copy_number;
>+ return escape_str(row._strings.copy_number ? row._strings.copy_number.str : row.copy_number);
> }
> },
> {
>@@ -2528,7 +2528,7 @@
> searchable: true,
> orderable: true,
> render: function (data, type, row, meta) {
>- return row.inventory_number;
>+ return escape_str(row.inventory_number);
> }
> },
> {
>@@ -2537,7 +2537,7 @@
> searchable: true,
> orderable: true,
> render: function (data, type, row, meta) {
>- return row.materials_notes;
>+ return escape_str(row.materials_notes);
> }
> },
> {
>@@ -2546,7 +2546,7 @@
> searchable: true,
> orderable: true,
> render: function (data, type, row, meta) {
>- return row.public_notes ? row.public_notes.replaceAll('\n', ' ') : '';
>+ return row.public_notes ? escape_str(row.public_notes).replaceAll('\n', ' ') : '';
> }
> },
> {
>@@ -2555,7 +2555,7 @@
> searchable: true,
> orderable: true,
> render: function (data, type, row, meta) {
>- return row.internal_notes;
>+ return escape_str(row.internal_notes);
> }
> },
> [% IF ( hostrecords ) %]
>@@ -2592,9 +2592,9 @@
> if ( c.enabled != 'yes' ) return;
> nodes += '';
> nodes += '<a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=%s">'.format(c.course_id);
>- nodes += c.course_name;
>+ nodes += escape_str(c.course_name);
> if ( c.section ) {
>- nodes += ' ' + c.section;
>+ nodes += ' ' + escape_str(c.section);
> }
> if ( c.term ) {
> nodes += ' ' + av_courses_term.get(c.term.toString());
>@@ -2611,7 +2611,7 @@
> searchable: false,
> orderable: false,
> render: function (data, type, row, meta) {
>- return '<a class="btn btn-default btn-xs print-label" href="/cgi-bin/koha/labels/spinelabel-print.pl?barcode=%s"> Print label</a>'.format(row.external_id);
>+ return '<a class="btn btn-default btn-xs print-label" href="/cgi-bin/koha/labels/spinelabel-print.pl?barcode=%s"> Print label</a>'.format(escape_str(row.external_id));
> }
> },
> [% END %]
>@@ -2633,7 +2633,7 @@
> }
> [% IF bundlesEnabled %]
> // FIXME How do we handle that correctly?
>- //nodes += '<button class="btn btn-default btn-xs details-control"> Manage bundle (%s|%s)</button>'.format(row.bundled, row.bundled_lost);
>+ //nodes += '<button class="btn btn-default btn-xs details-control"> Manage bundle (%s|%s)</button>'.format(escape_str(row.bundled), escape_str(row.bundled_lost));
> [% END %]
> 
> return nodes;
>-- 
>2.34.1

Actions: View | Diff | Splinter Review

Attachments on bug 33568: 151339 | 153791 | 164308 | 164309 | 164310 | 164311 | 164312 | 164313 | 164314 | 164315 | 164316 | 164317 | 164318 | 164319 | 164320 | 164321 | 164322 | 164323 | 164324 | 164325 | 164326 | 164327 | 164328 | 164329 | 164330 | 164331 | 164332 | 164333 | 164334 | 164335 | 164336 | 164337 | 164338 | 164339 | 164340 | 164341 | 164342 | 164343 | 164344 | 164345 | 164346 | 164347 | 164348 | 164349 | 164350 | 164351 | 164352 | 164353 | 164354 | 164355 | 164356 | 164358 | 164359 | 164360 | 164361 | 164362 | 164363 | 164364 | 164365 | 164366 | 164367 | 164368 | 164369 | 164370 | 164371 | 164372 | 164373 | 164374 | 164472 | 164480 | 164482 | 164483 | 164485 | 164528