From 763c39a8bfa95462f692821be89fb4320d1e0485 Mon Sep 17 00:00:00 2001 From: Andrew Isherwood Date: Fri, 8 Feb 2019 11:12:45 +0000 Subject: [PATCH] Bug 21063: (follow-up) Sanitize datatable data This mitigates bug 22268 by sanitizing data prior to display using the built in $.fn.dataTable.render.text() helper provided by Datatables. The patch was added here, rather that in 22268 since this is the bug that introduced the problem by increasing the number of fields that are displayed in the table, some of which could contain user provided malicious data --- .../prog/en/modules/ill/ill-requests.tt | 38 ++++++++++++++++++++-- 1 file changed, 35 insertions(+), 3 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt index fa941640c9..ea07d069d2 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt @@ -795,7 +795,8 @@ // Columns that require special treatment var specialCols = { action: { - func: createActionLink + func: createActionLink, + skipSanitize: true }, borrowernumber: { func: createPatronLink @@ -808,7 +809,8 @@ }, biblio_id: { name: _("Bibliograpic record ID"), - func: createBiblioLink + func: createBiblioLink, + skipSanitize: true }, metadata_Type: { func: createType @@ -818,6 +820,9 @@ }, patron_cardnumber: { name: _("Cardnumber") + }, + patron: { + skipSanitize: true } }; @@ -855,6 +860,21 @@ e.preventDefault(); $('#dataPreview').modal({show:true}); }); + + // Allow us to chain Datatable render helpers together, so we + // can use our custom functions and render.text(), which + // provides us with data sanitization + $.fn.dataTable.render.multi = function(renderArray) { + return function(d, type, row, meta) { + for(var r = 0; r < renderArray.length; r++) { + var toCall = renderArray[r].hasOwnProperty('display') ? + renderArray[r].display : + renderArray[r]; + d = toCall(d, type, row, meta); + } + return d; + } + } // Get our data from the API and process it prior to passing // it to datatables @@ -888,9 +908,21 @@ specialCols.hasOwnProperty(colName) && specialCols[colName].hasOwnProperty('func') ) { - colObj.render = specialCols[colName].func; + var renderArray = [ + specialCols[colName].func + ]; + if (!specialCols[colName].skipSanitize) { + renderArray.push( + $.fn.dataTable.render.text() + ); + } + + colObj.render = $.fn.dataTable.render.multi( + renderArray + ); } else { colObj.data = colName; + colObj.render = $.fn.dataTable.render.text() } // Make sure properties that aren't present in the API // response are populated with null to avoid Datatables -- 2.11.0