Bugzilla – Attachment 95817 Details for
Bug 13806
No input sanitization where creating Reports subgroup
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 13806: No input sanitization where creating Reports subgroup
Bug-13806-No-input-sanitization-where-creating-Rep.patch (text/plain), 9.25 KB, created by
Séverine Queune
on 2019-11-26 10:46:35 UTC
(
hide
)
Description:
Bug 13806: No input sanitization where creating Reports subgroup
Filename:
MIME Type:
Creator:
Séverine Queune
Created:
2019-11-26 10:46:35 UTC
Size:
9.25 KB
patch
obsolete
>From 3c9177694dd9a09c4b3163f69d6fc1d34ce2abe6 Mon Sep 17 00:00:00 2001 >From: Owen Leonard <oleonard@myacpl.org> >Date: Fri, 22 Nov 2019 16:47:45 +0000 >Subject: [PATCH] Bug 13806: No input sanitization where creating Reports > subgroup >MIME-Version: 1.0 >Content-Type: text/plain; charset=UTF-8 >Content-Transfer-Encoding: 8bit > >This patch adds validation of report group and subgroup inputs so that >the user can't enter data into only one half of the group code/name >pair. > >To test, apply the patch and go to Reports -> Use saved. > > - Create or edit a report which doesn't have a group or subgroup > assigned. > > - Under "Report group," select the "or create" radio button. > > - Click the "Update SQL" button to submit the form without entering a > group code or name. The form should require taht you enter data into > both fields. > > - Enter data into the report group code and name fields. Add data to > either the code or data field under "Report subgroup." You should > not be able to submit the form without populating both. > > - Start over editing a report which doesn't have a group or subgroup > assigned. > > - Select an existing group under "Report group." > > - Under "Report subgroup," select the "or create" option. > > - You should not be able to submit the form without adding data in > both the code and name fields for the report subgroup. > >Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr> >--- > .../en/modules/reports/guided_reports_start.tt | 80 ++++++++++++++++++---- > 1 file changed, 65 insertions(+), 15 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt >index cac8ccb..4ca5833 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt >@@ -614,7 +614,7 @@ canned reports and writing custom SQL reports.</p> > [% END %] > > [% IF ( save ) %] >-<form action="/cgi-bin/koha/reports/guided_reports.pl" method="post" class="validated"> >+<form action="/cgi-bin/koha/reports/guided_reports.pl" method="post" id="sql_report_form"> > <input type="hidden" name="sql" value="[% sql | html %]" /> > <input type="hidden" name="type" value="[% type | html %]" /> > <input type="hidden" name="area" value="[% area | html %]" /> >@@ -893,7 +893,7 @@ canned reports and writing custom SQL reports.</p> > [% END %] > > [% IF ( create ) %] >-<form action="/cgi-bin/koha/reports/guided_reports.pl" method="post" class="validated"> >+<form action="/cgi-bin/koha/reports/guided_reports.pl" method="post" id="sql_report_form"> > <fieldset class="rows"> > <legend>Create report from SQL</legend> > <ol> >@@ -970,7 +970,7 @@ canned reports and writing custom SQL reports.</p> > [% END %] > > [% IF ( editsql ) %] >-<form action="/cgi-bin/koha/reports/guided_reports.pl" method="post" class="validated"> >+<form action="/cgi-bin/koha/reports/guided_reports.pl" method="post" id="sql_report_form"> > <input type="hidden" name="phase" value="Update SQL" /> > <input type="hidden" name="id" value="[% id | html %]"/> > <fieldset class="rows"> >@@ -1131,6 +1131,20 @@ canned reports and writing custom SQL reports.</p> > mode: "text/x-sql", > lineWrapping: true > }); >+ >+ // https://stackoverflow.com/questions/2086287/how-to-clear-jquery-validation-error-messages#answer-16025232 >+ function clearValidation( formElement ){ >+ // formElement should be a jQuery object >+ var validator = formElement.validate(); >+ // Iterate through named elements inside of the form, and mark them as error free >+ $('[name]',formElement).each(function(){ >+ validator.successList.push(this);//mark as error free >+ validator.showErrors();//remove error messages if present >+ }); >+ validator.resetForm();//remove error class on name elements and clear history >+ validator.reset();//remove all error and success data >+ } >+ > [% END %] > > [% IF ( showsql ) %] >@@ -1466,11 +1480,31 @@ canned reports and writing custom SQL reports.</p> > }); > > [% IF (create || editsql || save) %] >+ >+ var validated_form = $("#sql_report_form").validate({ >+ reportname: "required", >+ group_input: { >+ required: { >+ depends: function(element) { >+ return $("#create_group").prop("checked") && $("#groupdesc_input").val() != ''; >+ } >+ } >+ }, >+ groupdesc_input: { >+ required: { >+ depends: function(element) { >+ return $("#create_group").prop("checked") && $("#group_input").val() != ''; >+ } >+ } >+ } >+ }); >+ > $("#select_group").change(function() { > if($(this).prop('checked')) { >- $("#group_input").prop('disabled', true); >- $("#groupdesc_input").prop('disabled', true); >+ $("#group_input").attr("class","").prop('disabled', true).prop("required", false); >+ $("#groupdesc_input").attr("class","").prop('disabled', true).prop("required", false); > $("#group_select").prop('disabled', false); >+ clearValidation( $("#sql_report_form") ); > if ($("#group_select").val().length > 0) { > $("#select_subgroup").prop('checked', true); > $("#select_subgroup").change(); >@@ -1482,30 +1516,46 @@ canned reports and writing custom SQL reports.</p> > }); > $("#create_group").change(function() { > if($(this).prop('checked')) { >- $("#group_input").prop('disabled', false); >- $("#groupdesc_input").prop('disabled', false); >+ $("#group_input").prop('disabled', false).prop("required", true ); >+ $("#groupdesc_input").prop('disabled', false).prop("required", true ); > $("#group_select").prop('disabled', true); >- $("#create_subgroup").prop('checked', true).change(); >+ // $("#create_subgroup").prop('checked', true).change(); > $("#subgroup_select").hide(); > $("#subgroup input[type='radio']").hide(); > $("#subgroup label[for]").hide(); >- $("#subgroup_input").show(); >- $("#subgroupdesc_input").show(); >+ $("#subgroup_input").prop("required", false ).prop("disabled", false).show(); >+ $("#subgroupdesc_input").prop("required", false ).prop("disabled", false).show(); > $("#subgroup").show(); >+ // Add validation rules for fields which were previously hidden >+ $("#subgroup_input").rules("add", { >+ required: { >+ depends: function(element) { >+ return $("#create_group").prop("checked") && $("#subgroupdesc_input").val() != ''; >+ } >+ } >+ }); >+ $("#subgroupdesc_input").rules("add", { >+ required: { >+ depends: function(element) { >+ return $("#create_group").prop("checked") && $("#subgroup_input").val() != ''; >+ } >+ } >+ }); > } > }); > $("#select_subgroup").change(function() { > if($(this).prop('checked')) { > $("#subgroup_select").prop('disabled', false); >- $("#subgroup_input").prop('disabled', true); >- $("#subgroupdesc_input").prop('disabled', true); >+ $("#subgroup_input").prop('disabled', true).prop("required", false ); >+ $("#subgroupdesc_input").prop('disabled', true).prop("required", false ); >+ clearValidation( $("#sql_report_form") ); > } > }); > $("#create_subgroup").change(function() { > if($(this).prop('checked')) { >- $("#subgroup_input").prop('disabled', false); >- $("#subgroupdesc_input").prop('disabled', false); >- $("#subgroup_select").prop('disabled', true); >+ $("#subgroup_input").prop('disabled', false).prop("required", true ); >+ $("#subgroupdesc_input").prop('disabled', false).prop("required", true ); >+ $("#subgroup_select").val("").prop('disabled', true); > } > }); > $("#select_group").change(); >-- >2.1.4
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=95817">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 13806
:
95733
|
95817
|
96010
|
96014