From b19c26b4f87e92ad003dad354723b0d9ec739af3 Mon Sep 17 00:00:00 2001 From: Hugh Davenport Date: Thu, 17 Jan 2013 16:35:23 +1300 Subject: [PATCH] bug 9411 Fix javascript evals to use parseInt and parseFloat The acq.js file used evals to parse the return text of ajax queries to determine what result to return. This is a bad thing, and can potentially cause security risks. This patch converts those eval calls to parseInt and parseFloat calls. Note: This patch depends on the patch in bug 4437 so there are no conflicts. Signed-off-by: Hugh Davenport --- koha-tmpl/intranet-tmpl/prog/en/js/acq.js | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/js/acq.js b/koha-tmpl/intranet-tmpl/prog/en/js/acq.js index 42684df..77984cf 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/js/acq.js +++ b/koha-tmpl/intranet-tmpl/prog/en/js/acq.js @@ -728,7 +728,6 @@ for (i=1;i<=2;i++) { url: url, mimeType: 'text/xml', success: function (data, textStatus, xmlhttp) { - // rc = eval ( xmlhttp.responseText ); var retRootType = jQuery(xmlhttp.responseXML).children().first().get(0).nodeName.toLowerCase(); var hasInputs = $sort_zone.has('input').length > 0; if (hasInputs && retRootType == 'input') { @@ -757,7 +756,7 @@ function totalExceedsBudget(budgetId, total) { mimeType: 'text/xml', async: false, // non-async because we need to return a value based on the result success: function(data, textStatus, xmlhttp) { - actTotal = eval ( xmlhttp.responseText ); + actTotal = parseFloat ( xmlhttp.responseText ); if ( Math.abs(actTotal) < Math.abs(total) ) { // if budget is to low :( @@ -788,11 +787,11 @@ if ( newBudgetParent ) { url += '&parent_id=' + newBudgetParent}; mimeType: 'text/xml', async: false, // non-async because we need to return a value based on the result success: function(data, textStatus, xmlhttp) { - var result = eval ( xmlhttp.responseText ); + var result = parseInt ( xmlhttp.responseText ); - if (result == '1') { + if (result == 1) { ret = _("- Budget total exceeds parent allocation\n"); - } else if (result == '2') { + } else if (result == 2) { ret = _("- Budget total exceeds period allocation\n"); } else { ret = false; @@ -814,11 +813,11 @@ function checkBudgetParent(budgetId, newBudgetParent) { mimeType: 'text/xml', async: false, // non-async because we need to return a value based on the result success: function(data, textStatus, xmlhttp) { - var result = eval ( xmlhttp.responseText ); + var result = parseInt ( xmlhttp.responseText ); - if (result == '1') { + if (result == 1) { ret = _("- New budget-parent is beneath budget\n"); -// } else if (result == '2') { +// } else if (result == 2) { // ret = "- New budget-parent has insufficent funds\n"; // } else { // ret = false; -- 1.7.10.4