Bug 18689 - Fix calendar error with double quotes in title or description of holiday
Summary: Fix calendar error with double quotes in title or description of holiday
Status: Pushed to Stable
Alias: None
Product: Koha
Classification: Unclassified
Component: Tools (show other bugs)
Version: master
Hardware: All All
: P5 - low major (vote)
Assignee: Marc Véron
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
: 15271 (view as bug list)
Depends on:
Blocks:
 
Reported: 2017-05-29 02:30 UTC by Barton Chittenden
Modified: 2017-07-31 11:21 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Anomaly result of following replication steps (35.62 KB, image/png)
2017-06-02 19:29 UTC, Lee Jamison
Details
Clarification of replication steps -- screenshot 1 (13.16 KB, image/png)
2017-06-03 23:28 UTC, Barton Chittenden
Details
Clarification of replication steps -- screenshot 2 (7.88 KB, image/png)
2017-06-03 23:30 UTC, Barton Chittenden
Details
Clarification of replication steps -- screenshot 3 (52.31 KB, image/png)
2017-06-03 23:33 UTC, Barton Chittenden
Details
Fix calendar error with double quotes in title or description of holiday (2.88 KB, patch)
2017-06-04 16:13 UTC, Marc Véron
Details | Diff | Splinter Review
Attachment to Bug 18689 - Fix calendar error with double quotes in title or description of holiday (2.94 KB, patch)
2017-06-05 12:40 UTC, Lee Jamison
Details | Diff | Splinter Review
Bug 18689: calendar error with double quotes in title or description of holiday (2.97 KB, patch)
2017-06-09 14:51 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Barton Chittenden 2017-05-29 02:30:12 UTC
To replicate:

1/ Go to Tools > Calendar
2/ Click on a date
3/ Enter a title with text enclosed in double quotes "like this".
4/ Click Save

This will cause a JavaScript error that prevents the calendar from displaying:

holidays.pl?branch=CPL&calendardate=2017-05-01:382 Uncaught SyntaxError: Unexpected identifier

Here's an example of the code that's erroring out:

holidays["2017/5/1"] = {title:"This will cause "failure". ", description:"asdf"};

The problem is that the quotes are not escaped.
Comment 1 Barton Chittenden 2017-05-29 02:35:44 UTC
Marking importance as major, because the bug creates an error that the user can't recover from.
Comment 2 Barton Chittenden 2017-05-29 16:05:58 UTC
*** Bug 15271 has been marked as a duplicate of this bug. ***
Comment 3 Lee Jamison 2017-06-02 19:29:02 UTC
Created attachment 63946 [details]
Anomaly result of following replication steps

Barton, I'm not sure if this would fall under this bug or a new bug, but when following your instructions to replicate I actually experienced a completely different result. I'm using Kohadevbox with a Debian 8 host. I followed the same procedure using both Google Chrome and Mozilla Firefox with the same result on both browsers.

What's happening for me is instead of a Javascript error, what I'm getting is literally an empty screen (see attachment). The empty screen ONLY occurs by putting double quotes around the title text.
Comment 4 Lee Jamison 2017-06-02 19:30:58 UTC
Also of note, using single quotes 'like this' does NOT cause the bug to occur. Single quotes result in expected behavior.
Comment 5 Marc Véron 2017-06-03 12:33:04 UTC
(In reply to Lee Jamison from comment #3)
> Created attachment 63946 [details]
> Anomaly result of following replication steps
> 
> Barton, I'm not sure if this would fall under this bug or a new bug, but
> when following your instructions to replicate I actually experienced a
> completely different result. I'm using Kohadevbox with a Debian 8 host. I
> followed the same procedure using both Google Chrome and Mozilla Firefox
> with the same result on both browsers.
> 
> What's happening for me is instead of a Javascript error, what I'm getting
> is literally an empty screen (see attachment). The empty screen ONLY occurs
> by putting double quotes around the title text.

I get such empty screen with at least one of title or text columns having quotes.
Comment 6 Barton Chittenden 2017-06-03 23:28:17 UTC
Created attachment 63949 [details]
Clarification of replication steps -- screenshot 1
Comment 7 Barton Chittenden 2017-06-03 23:30:04 UTC
Created attachment 63950 [details]
Clarification of replication steps -- screenshot 2
Comment 8 Barton Chittenden 2017-06-03 23:33:34 UTC
Created attachment 63951 [details]
Clarification of replication steps -- screenshot 3

I wasn't clear in my description -- Lee's screenshot shows exactly what I saw on the screen when I added double quotes to one of the text fields. I saw the JavaScript error when I launched Chrome developer tools, as shown in my attached screenshots.
Comment 9 Marc Véron 2017-06-04 16:13:06 UTC
Created attachment 63952 [details] [review]
Fix calendar error with double quotes in title or description of holiday

This patch fixes the calendar display with holidays having double qoutes in
title or description.

To test:
- Apply patch
- Go to Home > Tools > Calendar
- Create new holidays of each type (Day only, repeated wekly/yearly,
  range, yearly repeated range and enter double qoutes in their titles and
  descriptions
- Verify that calendar displays and works as expected
- Verify that you can edit the holidays
Comment 10 Lee Jamison 2017-06-05 12:40:38 UTC
Created attachment 63961 [details] [review]
Attachment to Bug 18689 - Fix calendar error with double quotes in title or description of holiday

Fix calendar error with double quotes in title or description of holiday

This patch fixes the calendar display with holidays having double qoutes in
title or description.

To test:
- Apply patch
- Go to Home > Tools > Calendar
- Create new holidays of each type (Day only, repeated wekly/yearly,
  range, yearly repeated range and enter double qoutes in their titles and
  descriptions
- Verify that calendar displays and works as expected
- Verify that you can edit the holidays

https://bugs.koha-community.org/show_bug.cgi?id=18689
Signed-off-by: Lee Jamison <ldjamison@marywood.edu>
Comment 11 Jonathan Druart 2017-06-09 14:51:39 UTC
Created attachment 64143 [details] [review]
Bug 18689: calendar error with double quotes in title or description of holiday

This patch fixes the calendar display with holidays having double qoutes in
title or description.

To test:
- Apply patch
- Go to Home > Tools > Calendar
- Create new holidays of each type (Day only, repeated wekly/yearly,
  range, yearly repeated range and enter double qoutes in their titles and
  descriptions
- Verify that calendar displays and works as expected
- Verify that you can edit the holidays

Signed-off-by: Lee Jamison <ldjamison@marywood.edu>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 12 Jonathan Druart 2017-06-09 15:47:38 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 13 Fridolin SOMERS 2017-06-12 10:22:37 UTC
Pushed to 17.05.x, will be in 17.05.01
Comment 14 Katrin Fischer 2017-06-13 06:00:24 UTC
This patch has been pushed to 16.11.x and will be in 16.11.09.
Comment 15 Mason James 2017-07-31 11:21:11 UTC
Pushed to 16.05.x, for 16.05.15 release