Bugzilla – Attachment 41803 Details for
Bug 14691
Can't delete patron with ' character in cardnumber
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 14691 - [Alternate] Can't delete patron with ' character in cardnumber
Bug-14691---Alternate-Cant-delete-patron-with--cha.patch (text/plain), 4.71 KB, created by
David Cook
on 2015-08-24 01:10:00 UTC
(
hide
)
Description:
Bug 14691 - [Alternate] Can't delete patron with ' character in cardnumber
Filename:
MIME Type:
Creator:
David Cook
Created:
2015-08-24 01:10:00 UTC
Size:
4.71 KB
patch
obsolete
>From e1577ece1563c9abf1ef512f2cb731f35277b058 Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Mon, 24 Aug 2015 10:47:16 +1000 >Subject: [PATCH] Bug 14691 - [Alternate] Can't delete patron with ' character > in cardnumber > >This patch adds a new Template Toolkit plugin. To use it, simple add >[% USE EscapeURI %] at the top of the template, and then use "escape_uri" >just as you would with the normal "uri" filter (e.g. "[% variable | escape_uri %]". > >It is based on the code from version 2.26 of Template::Filter::uri_filter(), >but with a fix for the RFC3986 reserved character definition. > >In versions prior to 2.26, single quotes weren't escapes, which causes >problems when trying to use the uri filter for text containing >single quotes within a single quoted string, as observed in some >Javascript for deleting patrons. > >Test plan: > >1. Create patron account with cardnumber sss'ssssssss and save the account. >2. Try to delete the account. Nothing happens. >3. Apply the patch, refresh the page. >4. Try to delete the account; note the Delete pop-up message that now appears; note >that the patron gets deleted if you click OK. >--- > Koha/Template/Plugin/EscapeURI.pm | 64 ++++++++++++++++++++++ > .../prog/en/includes/members-toolbar.inc | 3 +- > 2 files changed, 66 insertions(+), 1 deletion(-) > create mode 100755 Koha/Template/Plugin/EscapeURI.pm > mode change 100644 => 100755 koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc > >diff --git a/Koha/Template/Plugin/EscapeURI.pm b/Koha/Template/Plugin/EscapeURI.pm >new file mode 100755 >index 0000000..f26165a >--- /dev/null >+++ b/Koha/Template/Plugin/EscapeURI.pm >@@ -0,0 +1,64 @@ >+package Koha::Template::Plugin::EscapeURI; >+ >+# Copyright Prosentient Systems 2015 >+ >+# This file is part of Koha. >+# >+# Koha is free software; you can redistribute it and/or modify it >+# under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# Koha is distributed in the hope that it will be useful, but >+# WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with Koha; if not, see <http://www.gnu.org/licenses>. >+ >+use Modern::Perl; >+use Template::Plugin::Filter; >+use base qw( Template::Plugin::Filter ); >+ >+#This plugin is based on the original uri filter from version 2.26 of Template::Filters >+ >+our $UNSAFE_SPEC = { >+ RFC2732 => q{A-Za-z0-9\-_.!~*'()}, >+ RFC3986 => q{A-Za-z0-9\-\._~"}, #This is actually a regression as per https://github.com/abw/Template2/issues/13 >+ TRUE_RFC3986 => q{A-Za-z0-9\-\._~}, #http://tools.ietf.org/html/rfc3986#section-2.3 >+}; >+our $UNSAFE_CHARS = $UNSAFE_SPEC->{ TRUE_RFC3986 }; >+our $URI_REGEX; >+our $URI_ESCAPES; >+ >+sub init { >+ my $self = shift; >+ my $name = $self->{ _CONFIG }->{ name } || 'escape_uri'; >+ #Install a named filter so that we can use "| escape_uri" instead of "| $EscapeURI" >+ $self->install_filter($name); >+ return $self; >+} >+ >+sub uri_escapes { >+ return { >+ map { ( chr($_), sprintf("%%%02X", $_) ) } (0..255), >+ }; >+} >+ >+sub filter { >+ my ( $self, $text, $args, $config ) = @_; >+ return "" unless $text; >+ >+ $URI_REGEX ||= qr/([^$UNSAFE_CHARS])/; >+ $URI_ESCAPES ||= uri_escapes(); >+ >+ if ($] >= 5.008 && utf8::is_utf8($text)) { >+ utf8::encode($text); >+ } >+ >+ $text =~ s/$URI_REGEX/$URI_ESCAPES->{$1}/eg; >+ return $text; >+} >+ >+1; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc >old mode 100644 >new mode 100755 >index 70edbc0..5dfd112 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc >@@ -1,4 +1,5 @@ > [% USE Koha %] >+[% USE EscapeURI %] > [% SET NorwegianPatronDBEnable = Koha.Preference( 'NorwegianPatronDBEnable' ) %] > <script type="text/javascript"> > //<![CDATA[ >@@ -107,7 +108,7 @@ function update_child() { > function confirm_reregistration() { > var is_confirmed = window.confirm(_("Are you sure you want to renew this patron's registration?")); > if (is_confirmed) { >- window.location = '/cgi-bin/koha/members/setstatus.pl?borrowernumber=[% borrowernumber %]&cardnumber=[% cardnumber %]&desintation=[% destination %]&reregistration=y'; >+ window.location = '/cgi-bin/koha/members/setstatus.pl?borrowernumber=[% borrowernumber %]&cardnumber=[% cardnumber | escape_uri %]&desintation=[% destination %]&reregistration=y'; > } > } > function export_barcodes() { >-- >2.1.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 14691
:
41644
|
41645
|
41803
|
42897