From 066391112d955fcc3da1f36b25b5e860f3d976c6 Mon Sep 17 00:00:00 2001 From: Hugh Davenport Date: Thu, 17 Jan 2013 16:35:23 +1300 Subject: [PATCH] bug 9411 Fix javascript evals to use parseInt and parseFloat The acq.js file used evals to parse the return text of ajax queries to determine what result to return. This is a bad thing, and can potentially cause security risks. This patch converts those eval calls to parseInt and parseFloat calls. Note: This patch depends on the patch in bug 4437 so there are no conflicts. Signed-off-by: Hugh Davenport --- koha-tmpl/intranet-tmpl/prog/en/js/acq.js | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/js/acq.js b/koha-tmpl/intranet-tmpl/prog/en/js/acq.js index 2d73023..99d36a9 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/js/acq.js +++ b/koha-tmpl/intranet-tmpl/prog/en/js/acq.js @@ -728,7 +728,6 @@ for (i=1;i<=2;i++) { url: url, mimeType: 'text/xml', success: function (data, textStatus, xmlhttp) { - // rc = eval ( xmlhttp.responseText ); var retRootType = jQuery(xmlhttp.responseXML).children().first().get(0).nodeName.toLowerCase(); var hasInputs = $sort_zone.has('input').length > 0; if (hasInputs && retRootType == 'input') { @@ -757,7 +756,7 @@ function totalExceedsBudget(budgetId, total) { mimeType: 'text/xml', async: false, // non-async because we need to return a value based on the result success: function(data, textStatus, xmlhttp) { - actTotal = eval ( xmlhttp.responseText ); + actTotal = parseFloat ( xmlhttp.responseText ); if ( Math.abs(actTotal) < Math.abs(total) ) { // if budget is to low :( @@ -788,11 +787,11 @@ if ( newBudgetParent ) { url += '&parent_id=' + newBudgetParent}; mimeType: 'text/xml', async: false, // non-async because we need to return a value based on the result success: function(data, textStatus, xmlhttp) { - var result = eval ( xmlhttp.responseText ); + var result = parseInt ( xmlhttp.responseText ); - if (result == '1') { + if (result == 1) { ret = _("- Budget total exceeds parent allocation\n"); - } else if (result == '2') { + } else if (result == 2) { ret = _("- Budget total exceeds period allocation\n"); } else { ret = false; @@ -814,11 +813,11 @@ function checkBudgetParent(budgetId, newBudgetParent) { mimeType: 'text/xml', async: false, // non-async because we need to return a value based on the result success: function(data, textStatus, xmlhttp) { - var result = eval ( xmlhttp.responseText ); + var result = parseInt ( xmlhttp.responseText ); - if (result == '1') { + if (result == 1) { return _("- New budget-parent is beneath budget\n"); -// } else if (result == '2') { +// } else if (result == 2) { // return "- New budget-parent has insufficent funds\n"; // } else { // return false; -- 1.7.10.4