Attachment 48265 Details for Bug 15111 – Bug 15111: Do not include the antiClickjack legacy browser trick for greybox

[patch] Bug 15111: Do not include the antiClickjack legacy browser trick for greybox

Bug-15111-Do-not-include-the-antiClickjack-legacy-.patch (text/plain), 6.22 KB, created by Jonathan Druart on 2016-02-22 09:28:16 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2016-02-22 09:28:16 UTC

Size: 6.22 KB

patch

obsolete

>From 62936defc294d622b36c53230cf9cb594e0b8c0e Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Mon, 22 Feb 2016 09:24:29 +0000
>Subject: [PATCH] Bug 15111: Do not include the antiClickjack legacy browser
> trick for greybox
>
>Most of the scripts called via greybox (which uses iframe) don't include
>doc-head-close. But some do.
>This patch adds a popup parameter for these templates, not to include
>the legacy browser trick and avoid the replacement of the location.
>
>Test plan:
>1/ Export patroncard and label
>2/ translate itemtypes
>3/ click on a idref link at the OPAC
>---
> .../prog/en/includes/doc-head-close.inc              | 20 +++++++++++---------
> .../prog/en/modules/admin/localization.tt            |  2 +-
> .../prog/en/modules/labels/label-print.tt            |  2 +-
> .../prog/en/modules/patroncards/print.tt             |  2 +-
> .../bootstrap/en/includes/doc-head-close.inc         | 20 +++++++++++---------
> .../opac-tmpl/bootstrap/en/modules/opac-idref.tt     |  2 +-
> 6 files changed, 26 insertions(+), 22 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc
>index 7bf6a4f..93baebe 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc
>@@ -4,15 +4,17 @@
> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
> 
> [%# Prevent XFS attacks -%]
>-<style id="antiClickjack">body{display:none !important;}</style>
>-<script type="text/javascript">
>-   if (self === top) {
>-       var antiClickjack = document.getElementById("antiClickjack");
>-       antiClickjack.parentNode.removeChild(antiClickjack);
>-   } else {
>-       top.location = self.location;
>-   }
>-</script>
>+[% UNLESS popup %]
>+    <style id="antiClickjack">body{display:none !important;}</style>
>+    <script type="text/javascript">
>+       if (self === top) {
>+           var antiClickjack = document.getElementById("antiClickjack");
>+           antiClickjack.parentNode.removeChild(antiClickjack);
>+       } else {
>+           top.location = self.location;
>+       }
>+    </script>
>+[% END %]
> 
> <link rel="shortcut icon" href="[% IF ( IntranetFavicon ) %][% IntranetFavicon %][% ELSE %][% interface %]/[% theme %]/img/favicon.ico[% END %]" type="image/x-icon" />
> 
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt
>index 2d6e5b4..d6bbf45 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt
>@@ -1,6 +1,6 @@
> [% INCLUDE 'doc-head-open.inc' %]
> <title>Koha &rsaquo; Localization</title>
>-[% INCLUDE 'doc-head-close.inc' %]
>+[% INCLUDE 'doc-head-close.inc' popup => 1 %]
> <link rel="stylesheet" type="text/css" href="[% themelang %]/css/datatables.css" />
> [% INCLUDE 'greybox.inc' %]
> [% INCLUDE 'datatables.inc' %]
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt
>index af60eab..0f517d9 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt
>@@ -1,6 +1,6 @@
>     [% INCLUDE 'doc-head-open.inc' %]
>     <title>Koha &rsaquo; Tools &rsaquo; Label creator &rsaquo; Label printing/exporting</title>
>-    [% INCLUDE 'doc-head-close.inc' %]
>+    [% INCLUDE 'doc-head-close.inc' popup => 1 %]
>     <script type="text/javascript">
>         //<![CDATA[
>             function Done() {
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt
>index 3753b20..bf22842 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt
>@@ -1,6 +1,6 @@
>     [% INCLUDE 'doc-head-open.inc' %]
>     <title>Koha &rsaquo; Tools &rsaquo; Patron cards &rsaquo; Patron card printing/exporting</title>
>-    [% INCLUDE 'doc-head-close.inc' %]
>+    [% INCLUDE 'doc-head-close.inc' popup => 1%]
>     <script type="text/javascript">
>         //<![CDATA[
>             function Done() {
>diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc
>index 0fa238b..54cf6c7 100644
>--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc
>+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc
>@@ -3,15 +3,17 @@
> <meta name="viewport" content="width=device-width, initial-scale=1" />
> 
> [%# Prevent XFS attacks -%]
>-<style id="antiClickjack">body{display:none !important;}</style>
>-<script type="text/javascript">
>-   if (self === top) {
>-       var antiClickjack = document.getElementById("antiClickjack");
>-       antiClickjack.parentNode.removeChild(antiClickjack);
>-   } else {
>-       top.location = self.location;
>-   }
>-</script>
>+[% UNLESS popup %]
>+    <style id="antiClickjack">body{display:none !important;}</style>
>+    <script type="text/javascript">
>+       if (self === top) {
>+           var antiClickjack = document.getElementById("antiClickjack");
>+           antiClickjack.parentNode.removeChild(antiClickjack);
>+       } else {
>+           top.location = self.location;
>+       }
>+    </script>
>+[% END %]
> 
> <link rel="shortcut icon" href="[% IF ( OpacFavicon ) %][% OpacFavicon %][% ELSE %][% interface %]/[% theme %]/images/favicon.ico[% END %]" type="image/x-icon" />
> [% IF ( bidi ) %]
>diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt
>index c389c79..85a0191 100644
>--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt
>+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt
>@@ -1,7 +1,7 @@
> [% INCLUDE 'doc-head-open.inc' %]
> <title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your search IDREF for ppn [% unimarc3 %]</title>
> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
>-[% INCLUDE 'doc-head-close.inc' %]
>+[% INCLUDE 'doc-head-close.inc' popup => 1 %]
> [% BLOCK cssinclude %]
>   <style type="text/css">
>     ul.ui-tabs-nav li a, ul.ui-tabs-nav li span.a  { padding:0.6em 1em; }
>-- 
>2.7.0

Actions: View | Diff | Splinter Review

Attachments on bug 15111: 44289 | 44339 | 44622 | 44828 | 45444 | 48265 | 48440 | 48441 | 48442 | 48646 | 48647 | 48648