Bugzilla – Attachment 183581 Details for
Bug 40030
HTML should be escaped when viewing system preferences diff in Log viewer
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 40030: Escape values when displaying action logs comparison
Bug-40030-Escape-values-when-displaying-action-log.patch (text/plain), 7.93 KB, created by
Marcel de Rooy
on 2025-06-27 07:13:26 UTC
(
hide
)
Description:
Bug 40030: Escape values when displaying action logs comparison
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2025-06-27 07:13:26 UTC
Size:
7.93 KB
patch
obsolete
>From 408497a4a621b2eb0cba0314e614140bcb06bd19 Mon Sep 17 00:00:00 2001 >From: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> >Date: Wed, 25 Jun 2025 10:55:52 -0400 >Subject: [PATCH] Bug 40030: Escape values when displaying action logs > comparison >Content-Type: text/plain; charset=utf-8 > >When viewing the action logs for a system preference change, there is an >option to view a comparison between different log lines for the same >system preference. However, if a system preference value contains HTML >markup (e.g. in IntranetUserJS), the diff text is only escaped on >sections where a change is marked, so unchanged lines containing HTML >markup result in the HTML being rendered. > >Escape the string values for unchanged sections as well, to ensure that >HTML markup in the diff text will not be rendered. > >To test: >1. Edit IntranetUserJS and add some code that contains HTML markup. > For example: >$("body").append('<a id="helloworld" class="btn btn-default">Say hi</a>'); >2. Save the preference >3. Make another change to IntranetUserJS that does not affect the line > you just added, and save again to ensure there are at least 2 action > log lines for comparison >4. Go to Tools > Log viewer >5. Select System Preferences module and Submit >6. Find the log entries for the above two revisions to IntranetUserJS >7. Check the Compare checkboxes on those entries, and click View > comparison >--> Note that the HTML button is rendered in the comparison >8. Apply patch >9. Clear browser cache and refresh the page >10. Repeat step 7 >--> The button is not rendered and the code is displayed as written >11. Make a change to the line you added in step 1 (for example, replace > "Say hi" with "Say hello") >12. Refresh the page >13. Check the checkboxes for the newest 2 log entries and click View > comparison to view the diff for that last change >--> Confirm the change is shown correctly - the button is not rendered > and nothing has been double-escaped > >Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org> > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.js | 2 +- > koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.min.js | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.js b/koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.js >index 3e3cc47c23..4df57d4eeb 100644 >--- a/koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.js >+++ b/koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.js >@@ -59,7 +59,7 @@ function diffString( o, n ) { > for (n = out.n[i].row + 1; n < out.o.length && out.o[n].text == null; n++ ) { > pre += '<del>' + escape(out.o[n]) + oSpace[n] + "</del>"; > } >- str += " " + out.n[i].text + nSpace[i] + pre; >+ str += " " + escape(out.n[i].text) + nSpace[i] + pre; > } > } > } >diff --git a/koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.min.js b/koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.min.js >index 9420f1a67c..f2a45290d5 100644 >--- a/koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.min.js >+++ b/koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.min.js >@@ -7,4 +7,4 @@ > * > * More Info: > * http://ejohn.org/projects/javascript-diff-algorithm/ >- */function escape(a){var b=a;return b=b.replace(/&/g,"&"),b=b.replace(/</g,"<"),b=b.replace(/>/g,">"),b=b.replace(/"/g,"""),b}function diffString(a,b){a=a.replace(/\s+$/,""),b=b.replace(/\s+$/,"");var c=diff(a==""?[]:a.split(/\s+/),b==""?[]:b.split(/\s+/)),d="",e=a.match(/\s+/g);e==null?e=["\n"]:e.push("\n");var f=b.match(/\s+/g);f==null?f=["\n"]:f.push("\n");if(c.n.length==0)for(var g=0;g<c.o.length;g++)d+="<del>"+escape(c.o[g])+e[g]+"</del>";else{if(c.n[0].text==null)for(b=0;b<c.o.length&&c.o[b].text==null;b++)d+="<del>"+escape(c.o[b])+e[b]+"</del>";for(var g=0;g<c.n.length;g++)if(c.n[g].text==null)d+="<ins>"+escape(c.n[g])+f[g]+"</ins>";else{var h="";for(b=c.n[g].row+1;b<c.o.length&&c.o[b].text==null;b++)h+="<del>"+escape(c.o[b])+e[b]+"</del>";d+=" "+c.n[g].text+f[g]+h}}return d}function randomColor(){return"rgb("+Math.random()*100+"%, "+Math.random()*100+"%, "+Math.random()*100+"%)"}function diffString2(a,b){a=a.replace(/\s+$/,""),b=b.replace(/\s+$/,"");var c=diff(a==""?[]:a.split(/\s+/),b==""?[]:b.split(/\s+/)),d=a.match(/\s+/g);d==null?d=["\n"]:d.push("\n");var e=b.match(/\s+/g);e==null?e=["\n"]:e.push("\n");var f="",g=new Array;for(var h=0;h<c.o.length;h++)g[h]=randomColor(),c.o[h].text!=null?f+='<span style="background-color: '+g[h]+'">'+escape(c.o[h].text)+d[h]+"</span>":f+="<del>"+escape(c.o[h])+d[h]+"</del>";var i="";for(var h=0;h<c.n.length;h++)c.n[h].text!=null?i+='<span style="background-color: '+g[c.n[h].row]+'">'+escape(c.n[h].text)+e[h]+"</span>":i+="<ins>"+escape(c.n[h])+e[h]+"</ins>";return{o:f,n:i}}function diff(a,b){var c=new Object,d=new Object;for(var e=0;e<b.length;e++)c[b[e]]==null&&(c[b[e]]={rows:new Array,o:null}),c[b[e]].rows.push(e);for(var e=0;e<a.length;e++)d[a[e]]==null&&(d[a[e]]={rows:new Array,n:null}),d[a[e]].rows.push(e);for(var e in c)c[e].rows.length==1&&typeof d[e]!="undefined"&&d[e].rows.length==1&&(b[c[e].rows[0]]={text:b[c[e].rows[0]],row:d[e].rows[0]},a[d[e].rows[0]]={text:a[d[e].rows[0]],row:c[e].rows[0]});for(var e=0;e<b.length-1;e++)b[e].text!=null&&b[e+1].text==null&&b[e].row+1<a.length&&a[b[e].row+1].text==null&&b[e+1]==a[b[e].row+1]&&(b[e+1]={text:b[e+1],row:b[e].row+1},a[b[e].row+1]={text:a[b[e].row+1],row:e+1});for(var e=b.length-1;e>0;e--)b[e].text!=null&&b[e-1].text==null&&b[e].row>0&&a[b[e].row-1].text==null&&b[e-1]==a[b[e].row-1]&&(b[e-1]={text:b[e-1],row:b[e].row-1},a[b[e].row-1]={text:a[b[e].row-1],row:e-1});return{o:a,n:b}}; >\ No newline at end of file >+ */function escape(a){var b=a;return b=b.replace(/&/g,"&"),b=b.replace(/</g,"<"),b=b.replace(/>/g,">"),b=b.replace(/"/g,"""),b}function diffString(a,b){a=a.replace(/\s+$/,""),b=b.replace(/\s+$/,"");var c=diff(a==""?[]:a.split(/\s+/),b==""?[]:b.split(/\s+/)),d="",e=a.match(/\s+/g);e==null?e=["\n"]:e.push("\n");var f=b.match(/\s+/g);f==null?f=["\n"]:f.push("\n");if(c.n.length==0)for(var g=0;g<c.o.length;g++)d+="<del>"+escape(c.o[g])+e[g]+"</del>";else{if(c.n[0].text==null)for(b=0;b<c.o.length&&c.o[b].text==null;b++)d+="<del>"+escape(c.o[b])+e[b]+"</del>";for(var g=0;g<c.n.length;g++)if(c.n[g].text==null)d+="<ins>"+escape(c.n[g])+f[g]+"</ins>";else{var h="";for(b=c.n[g].row+1;b<c.o.length&&c.o[b].text==null;b++)h+="<del>"+escape(c.o[b])+e[b]+"</del>";d+=" "+escape(c.n[g].text)+f[g]+h}}return d}function randomColor(){return"rgb("+Math.random()*100+"%, "+Math.random()*100+"%, "+Math.random()*100+"%)"}function diffString2(a,b){a=a.replace(/\s+$/,""),b=b.replace(/\s+$/,"");var c=diff(a==""?[]:a.split(/\s+/),b==""?[]:b.split(/\s+/)),d=a.match(/\s+/g);d==null?d=["\n"]:d.push("\n");var e=b.match(/\s+/g);e==null?e=["\n"]:e.push("\n");var f="",g=new Array;for(var h=0;h<c.o.length;h++)g[h]=randomColor(),c.o[h].text!=null?f+='<span style="background-color: '+g[h]+'">'+escape(c.o[h].text)+d[h]+"</span>":f+="<del>"+escape(c.o[h])+d[h]+"</del>";var i="";for(var h=0;h<c.n.length;h++)c.n[h].text!=null?i+='<span style="background-color: '+g[c.n[h].row]+'">'+escape(c.n[h].text)+e[h]+"</span>":i+="<ins>"+escape(c.n[h])+e[h]+"</ins>";return{o:f,n:i}}function diff(a,b){var c=new Object,d=new Object;for(var e=0;e<b.length;e++)c[b[e]]==null&&(c[b[e]]={rows:new Array,o:null}),c[b[e]].rows.push(e);for(var e=0;e<a.length;e++)d[a[e]]==null&&(d[a[e]]={rows:new Array,n:null}),d[a[e]].rows.push(e);for(var e in c)c[e].rows.length==1&&typeof d[e]!="undefined"&&d[e].rows.length==1&&(b[c[e].rows[0]]={text:b[c[e].rows[0]],row:d[e].rows[0]},a[d[e].rows[0]]={text:a[d[e].rows[0]],row:c[e].rows[0]});for(var e=0;e<b.length-1;e++)b[e].text!=null&&b[e+1].text==null&&b[e].row+1<a.length&&a[b[e].row+1].text==null&&b[e+1]==a[b[e].row+1]&&(b[e+1]={text:b[e+1],row:b[e].row+1},a[b[e].row+1]={text:a[b[e].row+1],row:e+1});for(var e=b.length-1;e>0;e--)b[e].text!=null&&b[e-1].text==null&&b[e].row>0&&a[b[e].row-1].text==null&&b[e-1]==a[b[e].row-1]&&(b[e-1]={text:b[e-1],row:b[e].row-1},a[b[e].row-1]={text:a[b[e].row-1],row:e-1});return{o:a,n:b}}; >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 40030
:
182845
|
183510
|
183562
| 183581