From e1577ece1563c9abf1ef512f2cb731f35277b058 Mon Sep 17 00:00:00 2001 From: David Cook Date: Mon, 24 Aug 2015 10:47:16 +1000 Subject: [PATCH] Bug 14691 - [Alternate] Can't delete patron with ' character in cardnumber This patch adds a new Template Toolkit plugin. To use it, simple add [% USE EscapeURI %] at the top of the template, and then use "escape_uri" just as you would with the normal "uri" filter (e.g. "[% variable | escape_uri %]". It is based on the code from version 2.26 of Template::Filter::uri_filter(), but with a fix for the RFC3986 reserved character definition. In versions prior to 2.26, single quotes weren't escapes, which causes problems when trying to use the uri filter for text containing single quotes within a single quoted string, as observed in some Javascript for deleting patrons. Test plan: 1. Create patron account with cardnumber sss'ssssssss and save the account. 2. Try to delete the account. Nothing happens. 3. Apply the patch, refresh the page. 4. Try to delete the account; note the Delete pop-up message that now appears; note that the patron gets deleted if you click OK. --- Koha/Template/Plugin/EscapeURI.pm | 64 ++++++++++++++++++++++ .../prog/en/includes/members-toolbar.inc | 3 +- 2 files changed, 66 insertions(+), 1 deletion(-) create mode 100755 Koha/Template/Plugin/EscapeURI.pm mode change 100644 => 100755 koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc diff --git a/Koha/Template/Plugin/EscapeURI.pm b/Koha/Template/Plugin/EscapeURI.pm new file mode 100755 index 0000000..f26165a --- /dev/null +++ b/Koha/Template/Plugin/EscapeURI.pm @@ -0,0 +1,64 @@ +package Koha::Template::Plugin::EscapeURI; + +# Copyright Prosentient Systems 2015 + +# This file is part of Koha. +# +# Koha is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# Koha is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Koha; if not, see . + +use Modern::Perl; +use Template::Plugin::Filter; +use base qw( Template::Plugin::Filter ); + +#This plugin is based on the original uri filter from version 2.26 of Template::Filters + +our $UNSAFE_SPEC = { + RFC2732 => q{A-Za-z0-9\-_.!~*'()}, + RFC3986 => q{A-Za-z0-9\-\._~"}, #This is actually a regression as per https://github.com/abw/Template2/issues/13 + TRUE_RFC3986 => q{A-Za-z0-9\-\._~}, #http://tools.ietf.org/html/rfc3986#section-2.3 +}; +our $UNSAFE_CHARS = $UNSAFE_SPEC->{ TRUE_RFC3986 }; +our $URI_REGEX; +our $URI_ESCAPES; + +sub init { + my $self = shift; + my $name = $self->{ _CONFIG }->{ name } || 'escape_uri'; + #Install a named filter so that we can use "| escape_uri" instead of "| $EscapeURI" + $self->install_filter($name); + return $self; +} + +sub uri_escapes { + return { + map { ( chr($_), sprintf("%%%02X", $_) ) } (0..255), + }; +} + +sub filter { + my ( $self, $text, $args, $config ) = @_; + return "" unless $text; + + $URI_REGEX ||= qr/([^$UNSAFE_CHARS])/; + $URI_ESCAPES ||= uri_escapes(); + + if ($] >= 5.008 && utf8::is_utf8($text)) { + utf8::encode($text); + } + + $text =~ s/$URI_REGEX/$URI_ESCAPES->{$1}/eg; + return $text; +} + +1; diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc old mode 100644 new mode 100755 index 70edbc0..5dfd112 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc @@ -1,4 +1,5 @@ [% USE Koha %] +[% USE EscapeURI %] [% SET NorwegianPatronDBEnable = Koha.Preference( 'NorwegianPatronDBEnable' ) %]