| Summary: | showCartUpdate indirectly uses eval() | ||
|---|---|---|---|
| Product: | Koha | Reporter: | David Cook <dcook> |
| Component: | Architecture, internals, and plumbing | Assignee: | Owen Leonard <oleonard> |
| Status: | Needs documenting --- | QA Contact: | Marcel de Rooy <m.de.rooy> |
| Severity: | minor | ||
| Priority: | P5 - low | CC: | fridolin.somers, m.de.rooy |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Crowdfunding goal: | 0 |
| Patch complexity: | Small patch | Documentation contact: | |
| Documentation submission: | Text to go in the release notes: | ||
| Version(s) released in: |
25.05.00
|
Circulation function: | |
| Attachments: |
Bug 39262: Don't pass string literals to setTimeout
Bug 39262: Don't pass string literals to setTimeout Bug 39262: Don't pass string literals to setTimeout |
||
Created attachment 179078 [details] [review] Bug 39262: Don't pass string literals to setTimeout This patch updates a few places in our code where we pass string literals to JavaScript's setTimeout() function. This is not recommended: https://developer.mozilla.org/en-US/docs/Web/API/Window/setTimeout#passing_string_literals To test, apply the patch and clear your browser cache if necessary. - In the OPAC, perform a catalog search. From the search results page, test adding some items to the cart. The "Item has been added to your cart" message should appear and disappear correctly. - In the staff interface, view the contents of a list. Click the "Print list" button in the toolbar. A new tab should load and trigger the browser's print window. Printing the page or cancelling should automatically close the tab. - Go to Acquisitions -> Vendor -> Basket groups. In the "Open" tab, click the "Close and export as PDF" button. This should trigger a page reload and the creation of a PDF. The basket group should now appear under the "Closed" tab. Sponsored-by: Athens County Public Libraries Created attachment 179137 [details] [review] Bug 39262: Don't pass string literals to setTimeout This patch updates a few places in our code where we pass string literals to JavaScript's setTimeout() function. This is not recommended: https://developer.mozilla.org/en-US/docs/Web/API/Window/setTimeout#passing_string_literals To test, apply the patch and clear your browser cache if necessary. - In the OPAC, perform a catalog search. From the search results page, test adding some items to the cart. The "Item has been added to your cart" message should appear and disappear correctly. - In the staff interface, view the contents of a list. Click the "Print list" button in the toolbar. A new tab should load and trigger the browser's print window. Printing the page or cancelling should automatically close the tab. - Go to Acquisitions -> Vendor -> Basket groups. In the "Open" tab, click the "Close and export as PDF" button. This should trigger a page reload and the creation of a PDF. The basket group should now appear under the "Closed" tab. Sponsored-by: Athens County Public Libraries Signed-off-by: David Cook <dcook@prosentient.com.au> Thanks for taking care of these, Owen. Much appreciated. Created attachment 179321 [details] [review] Bug 39262: Don't pass string literals to setTimeout This patch updates a few places in our code where we pass string literals to JavaScript's setTimeout() function. This is not recommended: https://developer.mozilla.org/en-US/docs/Web/API/Window/setTimeout#passing_string_literals To test, apply the patch and clear your browser cache if necessary. - In the OPAC, perform a catalog search. From the search results page, test adding some items to the cart. The "Item has been added to your cart" message should appear and disappear correctly. - In the staff interface, view the contents of a list. Click the "Print list" button in the toolbar. A new tab should load and trigger the browser's print window. Printing the page or cancelling should automatically close the tab. - Go to Acquisitions -> Vendor -> Basket groups. In the "Open" tab, click the "Close and export as PDF" button. This should trigger a page reload and the creation of a PDF. The basket group should now appear under the "Closed" tab. Sponsored-by: Athens County Public Libraries Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Pushed for 25.05! Well done everyone, thank you! I prefer not impact 24.11.x |
In ./koha-tmpl/opac-tmpl/bootstrap/js/basket.js there is a function "showCartUpdate" which calls the following line: setTimeout("hideCart()", 2000); When you pass a string as the first argument to setTimeout, it performs an eval(). While I don't think there's any security risk in this, it's suboptimal, and it will cause problems when we try to use Content-Security-Policy later. We should just update this to the following: setTimeout(hideCart, 2000); -- There's probably other examples of this, but this is the one that jumped out to me while working on CSP.