From 979f23ebfb72fdfb0408225422bf6575ff34b03a Mon Sep 17 00:00:00 2001 From: Emily Lamancusa Date: Wed, 25 Jun 2025 10:55:52 -0400 Subject: [PATCH] Bug 40030: Escape values when displaying action logs comparison When viewing the action logs for a system preference change, there is an option to view a comparison between different log lines for the same system preference. However, if a system preference value contains HTML markup (e.g. in IntranetUserJS), the diff text is only escaped on sections where a change is marked, so unchanged lines containing HTML markup result in the HTML being rendered. Escape the string values for unchanged sections as well, to ensure that HTML markup in the diff text will not be rendered. To test: 1. Edit IntranetUserJS and add some code that contains HTML markup. For example: $("body").append('Say hi'); 2. Save the preference 3. Make another change to IntranetUserJS that does not affect the line you just added, and save again to ensure there are at least 2 action log lines for comparison 4. Go to Tools > Log viewer 5. Select System Preferences module and Submit 6. Find the log entries for the above two revisions to IntranetUserJS 7. Check the Compare checkboxes on those entries, and click View comparison --> Note that the HTML button is rendered in the comparison 8. Apply patch 9. Clear browser cache and refresh the page 10. Repeat step 7 --> The button is not rendered and the code is displayed as written 11. Make a change to the line you added in step 1 (for example, replace "Say hi" with "Say hello") 12. Refresh the page 13. Check the checkboxes for the newest 2 log entries and click View comparison to view the diff for that last change --> Confirm the change is shown correctly - the button is not rendered and nothing has been double-escaped --- koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.js | 2 +- koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.min.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.js b/koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.js index 3e3cc47c23..4df57d4eeb 100644 --- a/koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.js +++ b/koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.js @@ -59,7 +59,7 @@ function diffString( o, n ) { for (n = out.n[i].row + 1; n < out.o.length && out.o[n].text == null; n++ ) { pre += '' + escape(out.o[n]) + oSpace[n] + ""; } - str += " " + out.n[i].text + nSpace[i] + pre; + str += " " + escape(out.n[i].text) + nSpace[i] + pre; } } } diff --git a/koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.min.js b/koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.min.js index 9420f1a67c..f2a45290d5 100644 --- a/koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.min.js +++ b/koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.min.js @@ -7,4 +7,4 @@ * * More Info: * http://ejohn.org/projects/javascript-diff-algorithm/ - */function escape(a){var b=a;return b=b.replace(/&/g,"&"),b=b.replace(//g,">"),b=b.replace(/"/g,"""),b}function diffString(a,b){a=a.replace(/\s+$/,""),b=b.replace(/\s+$/,"");var c=diff(a==""?[]:a.split(/\s+/),b==""?[]:b.split(/\s+/)),d="",e=a.match(/\s+/g);e==null?e=["\n"]:e.push("\n");var f=b.match(/\s+/g);f==null?f=["\n"]:f.push("\n");if(c.n.length==0)for(var g=0;g"+escape(c.o[g])+e[g]+"";else{if(c.n[0].text==null)for(b=0;b"+escape(c.o[b])+e[b]+"";for(var g=0;g"+escape(c.n[g])+f[g]+"";else{var h="";for(b=c.n[g].row+1;b"+escape(c.o[b])+e[b]+"";d+=" "+c.n[g].text+f[g]+h}}return d}function randomColor(){return"rgb("+Math.random()*100+"%, "+Math.random()*100+"%, "+Math.random()*100+"%)"}function diffString2(a,b){a=a.replace(/\s+$/,""),b=b.replace(/\s+$/,"");var c=diff(a==""?[]:a.split(/\s+/),b==""?[]:b.split(/\s+/)),d=a.match(/\s+/g);d==null?d=["\n"]:d.push("\n");var e=b.match(/\s+/g);e==null?e=["\n"]:e.push("\n");var f="",g=new Array;for(var h=0;h'+escape(c.o[h].text)+d[h]+"":f+=""+escape(c.o[h])+d[h]+"";var i="";for(var h=0;h'+escape(c.n[h].text)+e[h]+"":i+=""+escape(c.n[h])+e[h]+"";return{o:f,n:i}}function diff(a,b){var c=new Object,d=new Object;for(var e=0;e0;e--)b[e].text!=null&&b[e-1].text==null&&b[e].row>0&&a[b[e].row-1].text==null&&b[e-1]==a[b[e].row-1]&&(b[e-1]={text:b[e-1],row:b[e].row-1},a[b[e].row-1]={text:a[b[e].row-1],row:e-1});return{o:a,n:b}}; \ No newline at end of file + */function escape(a){var b=a;return b=b.replace(/&/g,"&"),b=b.replace(//g,">"),b=b.replace(/"/g,"""),b}function diffString(a,b){a=a.replace(/\s+$/,""),b=b.replace(/\s+$/,"");var c=diff(a==""?[]:a.split(/\s+/),b==""?[]:b.split(/\s+/)),d="",e=a.match(/\s+/g);e==null?e=["\n"]:e.push("\n");var f=b.match(/\s+/g);f==null?f=["\n"]:f.push("\n");if(c.n.length==0)for(var g=0;g"+escape(c.o[g])+e[g]+"";else{if(c.n[0].text==null)for(b=0;b"+escape(c.o[b])+e[b]+"";for(var g=0;g"+escape(c.n[g])+f[g]+"";else{var h="";for(b=c.n[g].row+1;b"+escape(c.o[b])+e[b]+"";d+=" "+escape(c.n[g].text)+f[g]+h}}return d}function randomColor(){return"rgb("+Math.random()*100+"%, "+Math.random()*100+"%, "+Math.random()*100+"%)"}function diffString2(a,b){a=a.replace(/\s+$/,""),b=b.replace(/\s+$/,"");var c=diff(a==""?[]:a.split(/\s+/),b==""?[]:b.split(/\s+/)),d=a.match(/\s+/g);d==null?d=["\n"]:d.push("\n");var e=b.match(/\s+/g);e==null?e=["\n"]:e.push("\n");var f="",g=new Array;for(var h=0;h'+escape(c.o[h].text)+d[h]+"":f+=""+escape(c.o[h])+d[h]+"";var i="";for(var h=0;h'+escape(c.n[h].text)+e[h]+"":i+=""+escape(c.n[h])+e[h]+"";return{o:f,n:i}}function diff(a,b){var c=new Object,d=new Object;for(var e=0;e0;e--)b[e].text!=null&&b[e-1].text==null&&b[e].row>0&&a[b[e].row-1].text==null&&b[e-1]==a[b[e].row-1]&&(b[e-1]={text:b[e-1],row:b[e].row-1},a[b[e].row-1]={text:a[b[e].row-1],row:e-1});return{o:a,n:b}}; -- 2.39.5