Bug 21454 - Price filtered variables should not need to be html filtered
Summary: Price filtered variables should not need to be html filtered
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Test Suite (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on: 13618 21393
Blocks:
  Show dependency tree / graph
 
Reported: 2018-09-29 16:09 UTC by Jonathan Druart
Modified: 2019-10-14 19:57 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Bug 21454: Update the tests (579 bytes, patch)
2018-09-29 16:14 UTC, Jonathan Druart 		Details | Diff | Splinter Review
Bug 21454: Do not require html filter on Price (1.28 KB, patch)
2018-09-29 16:14 UTC, Jonathan Druart 		Details | Diff | Splinter Review
Bug 21454: Remove html filter for Price filtered variables (67.39 KB, patch)
2018-09-29 16:14 UTC, Jonathan Druart 		Details | Diff | Splinter Review
Bug 21454: Update the tests (650 bytes, patch)
2018-10-01 11:20 UTC, Kyle M Hall (khall) 		Details | Diff | Splinter Review
Bug 21454: Do not require html filter on Price (1.35 KB, patch)
2018-10-01 11:20 UTC, Kyle M Hall (khall) 		Details | Diff | Splinter Review
Bug 21454: Remove html filter for Price filtered variables (67.30 KB, patch)
2018-10-01 11:20 UTC, Kyle M Hall (khall) 		Details | Diff | Splinter Review
Show Obsolete (3) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2018-09-29 16:09:39 UTC 
The result of a variable escaped using the Price filter does not need to be html filtered, it is always a float.
Comment 1 Jonathan Druart 2018-09-29 16:14:14 UTC 
Created attachment 79614 [details] [review]
Bug 21454: Update the tests
Comment 2 Jonathan Druart 2018-09-29 16:14:19 UTC 
Created attachment 79615 [details] [review]
Bug 21454: Do not require html filter on Price

Test plan:
- Apply first patch
- Confirm that tests is failing (t/template_filters.t)
- Apply second patch
- Confirm that tests return green
- Apply last patch
- Confirm that prices are displayed correctly

QA step:
Edit a template and add the following 2 lines:
[% SET p = '<script>alert("foo");</script>' %]
[% x | $Price %]
=> Display '0.00'
Comment 3 Jonathan Druart 2018-09-29 16:14:23 UTC 
Created attachment 79616 [details] [review]
Bug 21454: Remove html filter for Price filtered variables

Generated with:
perl -p -i -e 's/\|\s?\$Price\s?\|\s?html\s%]/| \$Price %]/g' **/*.tt **/*.inc
Comment 4 Kyle M Hall (khall) 2018-10-01 11:20:43 UTC 
Created attachment 79703 [details] [review]
Bug 21454: Update the tests

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 5 Kyle M Hall (khall) 2018-10-01 11:20:53 UTC 
Created attachment 79704 [details] [review]
Bug 21454: Do not require html filter on Price

Test plan:
- Apply first patch
- Confirm that tests is failing (t/template_filters.t)
- Apply second patch
- Confirm that tests return green
- Apply last patch
- Confirm that prices are displayed correctly

QA step:
Edit a template and add the following 2 lines:
[% SET p = '<script>alert("foo");</script>' %]
[% x | $Price %]
=> Display '0.00'

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 6 Kyle M Hall (khall) 2018-10-01 11:20:56 UTC 
Created attachment 79705 [details] [review]
Bug 21454: Remove html filter for Price filtered variables

Generated with:
perl -p -i -e 's/\|\s?\$Price\s?\|\s?html\s%]/| \$Price %]/g' **/*.tt **/*.inc

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 7 Nick Clemens (kidclamp) 2018-10-01 13:01:51 UTC 
Moving to PQA - reviewed, changes all make sense
Comment 8 Nick Clemens (kidclamp) 2018-10-01 16:46:26 UTC 
Awesome work all!

Pushed to master for 18.11
Comment 9 Martin Renvoize (ashimema) 2018-10-05 15:53:54 UTC 
Dependency not in 18.05.x series.