Bug 21454

Summary: Price filtered variables should not need to be html filtered
Product: Koha Reporter: Jonathan Druart <jonathan.druart>
Component: Test SuiteAssignee: Jonathan Druart <jonathan.druart>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: martin.renvoize, nick
Version: unspecified   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21167
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Bug Depends on: 13618, 21393    
Bug Blocks:    
Attachments: Bug 21454: Update the tests
Bug 21454: Do not require html filter on Price
Bug 21454: Remove html filter for Price filtered variables
Bug 21454: Update the tests
Bug 21454: Do not require html filter on Price
Bug 21454: Remove html filter for Price filtered variables

Description Jonathan Druart 2018-09-29 16:09:39 UTC
The result of a variable escaped using the Price filter does not need to be html filtered, it is always a float.
Comment 1 Jonathan Druart 2018-09-29 16:14:14 UTC
Created attachment 79614 [details] [review]
Bug 21454: Update the tests
Comment 2 Jonathan Druart 2018-09-29 16:14:19 UTC
Created attachment 79615 [details] [review]
Bug 21454: Do not require html filter on Price

Test plan:
- Apply first patch
- Confirm that tests is failing (t/template_filters.t)
- Apply second patch
- Confirm that tests return green
- Apply last patch
- Confirm that prices are displayed correctly

QA step:
Edit a template and add the following 2 lines:
[% SET p = '<script>alert("foo");</script>' %]
[% x | $Price %]
=> Display '0.00'
Comment 3 Jonathan Druart 2018-09-29 16:14:23 UTC
Created attachment 79616 [details] [review]
Bug 21454: Remove html filter for Price filtered variables

Generated with:
perl -p -i -e 's/\|\s?\$Price\s?\|\s?html\s%]/| \$Price %]/g' **/*.tt **/*.inc
Comment 4 Kyle M Hall (khall) 2018-10-01 11:20:43 UTC
Created attachment 79703 [details] [review]
Bug 21454: Update the tests

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 5 Kyle M Hall (khall) 2018-10-01 11:20:53 UTC
Created attachment 79704 [details] [review]
Bug 21454: Do not require html filter on Price

Test plan:
- Apply first patch
- Confirm that tests is failing (t/template_filters.t)
- Apply second patch
- Confirm that tests return green
- Apply last patch
- Confirm that prices are displayed correctly

QA step:
Edit a template and add the following 2 lines:
[% SET p = '<script>alert("foo");</script>' %]
[% x | $Price %]
=> Display '0.00'

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 6 Kyle M Hall (khall) 2018-10-01 11:20:56 UTC
Created attachment 79705 [details] [review]
Bug 21454: Remove html filter for Price filtered variables

Generated with:
perl -p -i -e 's/\|\s?\$Price\s?\|\s?html\s%]/| \$Price %]/g' **/*.tt **/*.inc

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 7 Nick Clemens (kidclamp) 2018-10-01 13:01:51 UTC
Moving to PQA - reviewed, changes all make sense
Comment 8 Nick Clemens (kidclamp) 2018-10-01 16:46:26 UTC
Awesome work all!

Pushed to master for 18.11
Comment 9 Martin Renvoize (ashimema) 2018-10-05 15:53:54 UTC
Dependency not in 18.05.x series.