Bugzilla – Attachment 14650 Details for
Bug 9411
Multiple uses of javascript eval on ajax responses in acq.js
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
bug 9411 Fix javascript evals to use parseInt and parseFloat
bug-9411-Fix-javascript-evals-to-use-parseInt-and-.patch (text/plain), 3.25 KB, created by
Hugh Davenport
on 2013-01-17 04:43:42 UTC
(
hide
)
Description:
bug 9411 Fix javascript evals to use parseInt and parseFloat
Filename:
MIME Type:
Creator:
Hugh Davenport
Created:
2013-01-17 04:43:42 UTC
Size:
3.25 KB
patch
obsolete
>From b19c26b4f87e92ad003dad354723b0d9ec739af3 Mon Sep 17 00:00:00 2001 >From: Hugh Davenport <hugh@davenport.net.nz> >Date: Thu, 17 Jan 2013 16:35:23 +1300 >Subject: [PATCH] bug 9411 Fix javascript evals to use parseInt and parseFloat > >The acq.js file used evals to parse the return text of ajax queries >to determine what result to return. This is a bad thing, and can >potentially cause security risks. > >This patch converts those eval calls to parseInt and parseFloat >calls. > >Note: This patch depends on the patch in bug 4437 so there are no >conflicts. > >Signed-off-by: Hugh Davenport <hugh@davenport.net.nz> >--- > koha-tmpl/intranet-tmpl/prog/en/js/acq.js | 15 +++++++-------- > 1 file changed, 7 insertions(+), 8 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/js/acq.js b/koha-tmpl/intranet-tmpl/prog/en/js/acq.js >index 42684df..77984cf 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/js/acq.js >+++ b/koha-tmpl/intranet-tmpl/prog/en/js/acq.js >@@ -728,7 +728,6 @@ for (i=1;i<=2;i++) { > url: url, > mimeType: 'text/xml', > success: function (data, textStatus, xmlhttp) { >- // rc = eval ( xmlhttp.responseText ); > var retRootType = jQuery(xmlhttp.responseXML).children().first().get(0).nodeName.toLowerCase(); > var hasInputs = $sort_zone.has('input').length > 0; > if (hasInputs && retRootType == 'input') { >@@ -757,7 +756,7 @@ function totalExceedsBudget(budgetId, total) { > mimeType: 'text/xml', > async: false, // non-async because we need to return a value based on the result > success: function(data, textStatus, xmlhttp) { >- actTotal = eval ( xmlhttp.responseText ); >+ actTotal = parseFloat ( xmlhttp.responseText ); > > if ( Math.abs(actTotal) < Math.abs(total) ) { > // if budget is to low :( >@@ -788,11 +787,11 @@ if ( newBudgetParent ) { url += '&parent_id=' + newBudgetParent}; > mimeType: 'text/xml', > async: false, // non-async because we need to return a value based on the result > success: function(data, textStatus, xmlhttp) { >- var result = eval ( xmlhttp.responseText ); >+ var result = parseInt ( xmlhttp.responseText ); > >- if (result == '1') { >+ if (result == 1) { > ret = _("- Budget total exceeds parent allocation\n"); >- } else if (result == '2') { >+ } else if (result == 2) { > ret = _("- Budget total exceeds period allocation\n"); > } else { > ret = false; >@@ -814,11 +813,11 @@ function checkBudgetParent(budgetId, newBudgetParent) { > mimeType: 'text/xml', > async: false, // non-async because we need to return a value based on the result > success: function(data, textStatus, xmlhttp) { >- var result = eval ( xmlhttp.responseText ); >+ var result = parseInt ( xmlhttp.responseText ); > >- if (result == '1') { >+ if (result == 1) { > ret = _("- New budget-parent is beneath budget\n"); >-// } else if (result == '2') { >+// } else if (result == 2) { > // ret = "- New budget-parent has insufficent funds\n"; > // } else { > // ret = false; >-- >1.7.10.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 9411
:
14648
|
14650
|
14652