From 8d376739b28dd055cc2534cc1518724f7d5ad9d7 Mon Sep 17 00:00:00 2001 From: Emily Lamancusa Date: Thu, 29 May 2025 12:35:44 -0400 Subject: [PATCH] Bug 40030: Escape values when displaying action logs comparison When viewing the action logs for a system preference change, there is an option to view a comparison between different log lines for the same system preference. Escape the string values before displaying the comparison so that any HTML (e.g. in IntranetUserJS) is not rendered. To test: 1. Edit IntranetUserJS and add some code that contains HTML markup. For example: $("body").append('Say hi'); 2. Save the preference 3. Make another change to IntranetUserJS (for example, add a space somewhere) and save again to ensure there are at least 2 action log lines for comparison 4. Go to Tools > Log viewer 5. Select System Preferences module and Submit 6. Find the log entries for the above two revisions to IntranetUserJS 7. Check the Compare checkboxes on those entries, and click View comparison --> Note that the HTML button is rendered in the comparison 8. Apply patch 9. Clear browser cache and refresh the page 10. Repeat step 7 --> The button is not rendered and the code is displayed as written --- koha-tmpl/intranet-tmpl/prog/js/viewlog.js | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/js/viewlog.js b/koha-tmpl/intranet-tmpl/prog/js/viewlog.js index 417dcaf18b..25090004ca 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/viewlog.js +++ b/koha-tmpl/intranet-tmpl/prog/js/viewlog.js @@ -138,7 +138,10 @@ $(document).ready(function () { var secondid = $(".compare:checked").eq(1).data("actionid"); var firstvalue = $("#loginfo" + firstid).text(); var secondvalue = $("#loginfo" + secondid).text(); - var diffs = diffString(secondvalue, firstvalue); + var diffs = diffString( + escape_str(secondvalue), + escape_str(firstvalue) + ); $("#col1 pre,#col2 pre").html(diffs); $("#compareInfo").modal("show"); } -- 2.34.1