From 29a3e17405f4a9f34a6dbe98cd7799dc2fcba8fa Mon Sep 17 00:00:00 2001 From: Andrew Isherwood Date: Fri, 8 Feb 2019 11:12:45 +0000 Subject: [PATCH] Bug 21063: (follow-up) Sanitize datatable data This mitigates bug 22268 by sanitizing data prior to display using the built in $.fn.dataTable.render.text() helper provided by Datatables. The patch was added here, rather that in 22268 since this is the bug that introduced the problem by increasing the number of fields that are displayed in the table, some of which could contain user provided malicious data Signed-off-by: Josef Moravec --- .../prog/en/modules/ill/ill-requests.tt | 38 ++++++++++++++++++++-- 1 file changed, 35 insertions(+), 3 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt index 159ef64..bc5d8b9 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt @@ -822,7 +822,8 @@ // Columns that require special treatment var specialCols = { action: { - func: createActionLink + func: createActionLink, + skipSanitize: true }, borrowernumber: { func: createPatronLink @@ -835,7 +836,8 @@ }, biblio_id: { name: _("Bibliograpic record ID"), - func: createBiblioLink + func: createBiblioLink, + skipSanitize: true }, metadata_Type: { func: createType @@ -845,6 +847,9 @@ }, patron_cardnumber: { name: _("Cardnumber") + }, + patron: { + skipSanitize: true } }; @@ -889,6 +894,21 @@ $('#dataPreview').modal({show:true}); }); + // Allow us to chain Datatable render helpers together, so we + // can use our custom functions and render.text(), which + // provides us with data sanitization + $.fn.dataTable.render.multi = function(renderArray) { + return function(d, type, row, meta) { + for(var r = 0; r < renderArray.length; r++) { + var toCall = renderArray[r].hasOwnProperty('display') ? + renderArray[r].display : + renderArray[r]; + d = toCall(d, type, row, meta); + } + return d; + } + } + // Get our data from the API and process it prior to passing // it to datatables var ajax = $.ajax( @@ -921,9 +941,21 @@ specialCols.hasOwnProperty(colName) && specialCols[colName].hasOwnProperty('func') ) { - colObj.render = specialCols[colName].func; + var renderArray = [ + specialCols[colName].func + ]; + if (!specialCols[colName].skipSanitize) { + renderArray.push( + $.fn.dataTable.render.text() + ); + } + + colObj.render = $.fn.dataTable.render.multi( + renderArray + ); } else { colObj.data = colName; + colObj.render = $.fn.dataTable.render.text() } // Make sure properties that aren't present in the API // response are populated with null to avoid Datatables -- 2.1.4