From 25e61bc1fdda3304e1fb1b4929633fdb3539a7a4 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Mon, 22 Feb 2016 09:24:29 +0000
Subject: [PATCH] Bug 15111: Do not include the antiClickjack legacy browser
 trick for greybox

Most of the scripts called via greybox (which uses iframe) don't include
doc-head-close. But some do.
This patch adds a popup parameter for these templates, not to include
the legacy browser trick and avoid the replacement of the location.

Test plan:
1/ Export patroncard and label
2/ translate itemtypes
3/ click on a idref link at the OPAC

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
---
 .../prog/en/includes/doc-head-close.inc              | 20 +++++++++++---------
 .../prog/en/modules/admin/localization.tt            |  2 +-
 .../prog/en/modules/labels/label-print.tt            |  2 +-
 .../prog/en/modules/patroncards/print.tt             |  2 +-
 .../bootstrap/en/includes/doc-head-close.inc         | 20 +++++++++++---------
 .../opac-tmpl/bootstrap/en/modules/opac-idref.tt     |  2 +-
 6 files changed, 26 insertions(+), 22 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc
index 7bf6a4f..93baebe 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc
@@ -4,15 +4,17 @@
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
 
 [%# Prevent XFS attacks -%]
-<style id="antiClickjack">body{display:none !important;}</style>
-<script type="text/javascript">
-   if (self === top) {
-       var antiClickjack = document.getElementById("antiClickjack");
-       antiClickjack.parentNode.removeChild(antiClickjack);
-   } else {
-       top.location = self.location;
-   }
-</script>
+[% UNLESS popup %]
+    <style id="antiClickjack">body{display:none !important;}</style>
+    <script type="text/javascript">
+       if (self === top) {
+           var antiClickjack = document.getElementById("antiClickjack");
+           antiClickjack.parentNode.removeChild(antiClickjack);
+       } else {
+           top.location = self.location;
+       }
+    </script>
+[% END %]
 
 <link rel="shortcut icon" href="[% IF ( IntranetFavicon ) %][% IntranetFavicon %][% ELSE %][% interface %]/[% theme %]/img/favicon.ico[% END %]" type="image/x-icon" />
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt
index 2d6e5b4..d6bbf45 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt
@@ -1,6 +1,6 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Localization</title>
-[% INCLUDE 'doc-head-close.inc' %]
+[% INCLUDE 'doc-head-close.inc' popup => 1 %]
 <link rel="stylesheet" type="text/css" href="[% themelang %]/css/datatables.css" />
 [% INCLUDE 'greybox.inc' %]
 [% INCLUDE 'datatables.inc' %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt
index af60eab..0f517d9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt
@@ -1,6 +1,6 @@
     [% INCLUDE 'doc-head-open.inc' %]
     <title>Koha &rsaquo; Tools &rsaquo; Label creator &rsaquo; Label printing/exporting</title>
-    [% INCLUDE 'doc-head-close.inc' %]
+    [% INCLUDE 'doc-head-close.inc' popup => 1 %]
     <script type="text/javascript">
         //<![CDATA[
             function Done() {
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt
index 3753b20..bf22842 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt
@@ -1,6 +1,6 @@
     [% INCLUDE 'doc-head-open.inc' %]
     <title>Koha &rsaquo; Tools &rsaquo; Patron cards &rsaquo; Patron card printing/exporting</title>
-    [% INCLUDE 'doc-head-close.inc' %]
+    [% INCLUDE 'doc-head-close.inc' popup => 1%]
     <script type="text/javascript">
         //<![CDATA[
             function Done() {
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc
index 0fa238b..54cf6c7 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc
@@ -3,15 +3,17 @@
 <meta name="viewport" content="width=device-width, initial-scale=1" />
 
 [%# Prevent XFS attacks -%]
-<style id="antiClickjack">body{display:none !important;}</style>
-<script type="text/javascript">
-   if (self === top) {
-       var antiClickjack = document.getElementById("antiClickjack");
-       antiClickjack.parentNode.removeChild(antiClickjack);
-   } else {
-       top.location = self.location;
-   }
-</script>
+[% UNLESS popup %]
+    <style id="antiClickjack">body{display:none !important;}</style>
+    <script type="text/javascript">
+       if (self === top) {
+           var antiClickjack = document.getElementById("antiClickjack");
+           antiClickjack.parentNode.removeChild(antiClickjack);
+       } else {
+           top.location = self.location;
+       }
+    </script>
+[% END %]
 
 <link rel="shortcut icon" href="[% IF ( OpacFavicon ) %][% OpacFavicon %][% ELSE %][% interface %]/[% theme %]/images/favicon.ico[% END %]" type="image/x-icon" />
 [% IF ( bidi ) %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt
index c389c79..85a0191 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt
@@ -1,7 +1,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your search IDREF for ppn [% unimarc3 %]</title>
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-[% INCLUDE 'doc-head-close.inc' %]
+[% INCLUDE 'doc-head-close.inc' popup => 1 %]
 [% BLOCK cssinclude %]
   <style type="text/css">
     ul.ui-tabs-nav li a, ul.ui-tabs-nav li span.a  { padding:0.6em 1em; }
-- 
2.7.0