| Summary: | Unexpected characters in ILL standard form JS can break translations | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Victor Grousset/tuxayo <victor> |
| Component: | I18N/L10N | Assignee: | Bugs List <koha-bugs> |
| Status: | NEW --- | QA Contact: | Testopia <testopia> |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | dcook, f.demians, jonathan.druart, pedro.amorim |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Bug Depends on: | 36221, 38340 | ||
| Bug Blocks: | |||
|
Description
Victor Grousset/tuxayo
2024-11-23 03:28:08 UTC
It looks like this has been moved into these files: ./koha-tmpl/opac-tmpl/bootstrap/en/includes/ill/backends/Standard/shared/shared.js ./koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/shared/shared.js And one day we really need to forbid creating HTML from Javascript strings. That said, what's the expected problem here? A single quote shouldn't be an issue since the HTML is encased in double quotes, but a double quote could be since that would create invalid HTML. Unless the problem is with __() specifically? It's been a little while since I looked at that specifically. Admittedly, I'm not super familiar with the entire translation process in Koha start to finish. Here's some steps I took: sudo apt-get install koha-l10n --reinstall ./debian/scripts/koha-translate -i fr-FR -d kohadev vi koha-tmpl/intranet-tmpl/prog/fr-FR/js/locale_data.js The "Delete" translation probably wouldn't cause syntax errors, but it could be used to inject XSS, although in theory the Translation Manager should catch that? It looks like "key" and "value" aren't currently translated... but I can test it anyway by manually editing locale_data.js. We'll inject this string into locale_data.js: "key":[null,"\"cle\""], After we install fr-FR, change to French, enable ILLModule, and go to http://localhost:8081/cgi-bin/koha/ill/ill-requests.pl?method=create&backend=Standard we click on "Nouvelle demande de PEB", and we click on "Ajouter un nouveau champ". Et voilĂ ... no placeholder text because we've accidentally generated <input type="text" class="custom-name " name="custom_key" placeholder="" cle""=""> Now this is easy to avoid by using Javascript like document.createElement() to create the HTML Element Javascript object.
Then to set the placeholder we can just do this:
custom_name.placeholder = __("key");
By using the browser web APIs and avoiding Javascript string manipulation, we set the placeholder more securely and more robustly.
--
We also don't even need jQuery to do this. Javascript has advanced so much that this can easily be done in regular Javascript, which is easier to maintain in the long-run as well.
|