Bug 18689

Summary: Fix calendar error with double quotes in title or description of holiday
Product: Koha Reporter: Barton Chittenden <barton>
Component: ToolsAssignee: Marc Véron <veron>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: fridolin.somers, katrin.fischer, ldjamison, mtj, nick, veron
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15271
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11235
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13747
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5471
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9814
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16976
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16863
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17151
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18727
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Anomaly result of following replication steps
Clarification of replication steps -- screenshot 1
Clarification of replication steps -- screenshot 2
Clarification of replication steps -- screenshot 3
Fix calendar error with double quotes in title or description of holiday
Attachment to Bug 18689 - Fix calendar error with double quotes in title or description of holiday
Bug 18689: calendar error with double quotes in title or description of holiday

Description Barton Chittenden 2017-05-29 02:30:12 UTC
To replicate:

1/ Go to Tools > Calendar
2/ Click on a date
3/ Enter a title with text enclosed in double quotes "like this".
4/ Click Save

This will cause a JavaScript error that prevents the calendar from displaying:

holidays.pl?branch=CPL&calendardate=2017-05-01:382 Uncaught SyntaxError: Unexpected identifier

Here's an example of the code that's erroring out:

holidays["2017/5/1"] = {title:"This will cause "failure". ", description:"asdf"};

The problem is that the quotes are not escaped.
Comment 1 Barton Chittenden 2017-05-29 02:35:44 UTC
Marking importance as major, because the bug creates an error that the user can't recover from.
Comment 2 Barton Chittenden 2017-05-29 16:05:58 UTC
*** Bug 15271 has been marked as a duplicate of this bug. ***
Comment 3 Lee Jamison 2017-06-02 19:29:02 UTC
Created attachment 63946 [details]
Anomaly result of following replication steps

Barton, I'm not sure if this would fall under this bug or a new bug, but when following your instructions to replicate I actually experienced a completely different result. I'm using Kohadevbox with a Debian 8 host. I followed the same procedure using both Google Chrome and Mozilla Firefox with the same result on both browsers.

What's happening for me is instead of a Javascript error, what I'm getting is literally an empty screen (see attachment). The empty screen ONLY occurs by putting double quotes around the title text.
Comment 4 Lee Jamison 2017-06-02 19:30:58 UTC
Also of note, using single quotes 'like this' does NOT cause the bug to occur. Single quotes result in expected behavior.
Comment 5 Marc Véron 2017-06-03 12:33:04 UTC
(In reply to Lee Jamison from comment #3)
> Created attachment 63946 [details]
> Anomaly result of following replication steps
> 
> Barton, I'm not sure if this would fall under this bug or a new bug, but
> when following your instructions to replicate I actually experienced a
> completely different result. I'm using Kohadevbox with a Debian 8 host. I
> followed the same procedure using both Google Chrome and Mozilla Firefox
> with the same result on both browsers.
> 
> What's happening for me is instead of a Javascript error, what I'm getting
> is literally an empty screen (see attachment). The empty screen ONLY occurs
> by putting double quotes around the title text.

I get such empty screen with at least one of title or text columns having quotes.
Comment 6 Barton Chittenden 2017-06-03 23:28:17 UTC
Created attachment 63949 [details]
Clarification of replication steps -- screenshot 1
Comment 7 Barton Chittenden 2017-06-03 23:30:04 UTC
Created attachment 63950 [details]
Clarification of replication steps -- screenshot 2
Comment 8 Barton Chittenden 2017-06-03 23:33:34 UTC
Created attachment 63951 [details]
Clarification of replication steps -- screenshot 3

I wasn't clear in my description -- Lee's screenshot shows exactly what I saw on the screen when I added double quotes to one of the text fields. I saw the JavaScript error when I launched Chrome developer tools, as shown in my attached screenshots.
Comment 9 Marc Véron 2017-06-04 16:13:06 UTC
Created attachment 63952 [details] [review]
Fix calendar error with double quotes in title or description of holiday

This patch fixes the calendar display with holidays having double qoutes in
title or description.

To test:
- Apply patch
- Go to Home > Tools > Calendar
- Create new holidays of each type (Day only, repeated wekly/yearly,
  range, yearly repeated range and enter double qoutes in their titles and
  descriptions
- Verify that calendar displays and works as expected
- Verify that you can edit the holidays
Comment 10 Lee Jamison 2017-06-05 12:40:38 UTC
Created attachment 63961 [details] [review]
Attachment to Bug 18689 - Fix calendar error with double quotes in title or description of holiday

Fix calendar error with double quotes in title or description of holiday

This patch fixes the calendar display with holidays having double qoutes in
title or description.

To test:
- Apply patch
- Go to Home > Tools > Calendar
- Create new holidays of each type (Day only, repeated wekly/yearly,
  range, yearly repeated range and enter double qoutes in their titles and
  descriptions
- Verify that calendar displays and works as expected
- Verify that you can edit the holidays

https://bugs.koha-community.org/show_bug.cgi?id=18689
Signed-off-by: Lee Jamison <ldjamison@marywood.edu>
Comment 11 Jonathan Druart 2017-06-09 14:51:39 UTC
Created attachment 64143 [details] [review]
Bug 18689: calendar error with double quotes in title or description of holiday

This patch fixes the calendar display with holidays having double qoutes in
title or description.

To test:
- Apply patch
- Go to Home > Tools > Calendar
- Create new holidays of each type (Day only, repeated wekly/yearly,
  range, yearly repeated range and enter double qoutes in their titles and
  descriptions
- Verify that calendar displays and works as expected
- Verify that you can edit the holidays

Signed-off-by: Lee Jamison <ldjamison@marywood.edu>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 12 Jonathan Druart 2017-06-09 15:47:38 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 13 Fridolin Somers 2017-06-12 10:22:37 UTC
Pushed to 17.05.x, will be in 17.05.01
Comment 14 Katrin Fischer 2017-06-13 06:00:24 UTC
This patch has been pushed to 16.11.x and will be in 16.11.09.
Comment 15 Mason James 2017-07-31 11:21:11 UTC
Pushed to 16.05.x, for 16.05.15 release