Bug 21454 - Price filtered variables should not need to be html filtered
Summary: Price filtered variables should not need to be html filtered
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Test Suite (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on: 13618 21393
Blocks:
  Show dependency treegraph
 
Reported: 2018-09-29 16:09 UTC by Jonathan Druart
Modified: 2019-10-14 19:57 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 21454: Update the tests (579 bytes, patch)
2018-09-29 16:14 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 21454: Do not require html filter on Price (1.28 KB, patch)
2018-09-29 16:14 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 21454: Remove html filter for Price filtered variables (67.39 KB, patch)
2018-09-29 16:14 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 21454: Update the tests (650 bytes, patch)
2018-10-01 11:20 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 21454: Do not require html filter on Price (1.35 KB, patch)
2018-10-01 11:20 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 21454: Remove html filter for Price filtered variables (67.30 KB, patch)
2018-10-01 11:20 UTC, Kyle M Hall
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2018-09-29 16:09:39 UTC
The result of a variable escaped using the Price filter does not need to be html filtered, it is always a float.
Comment 1 Jonathan Druart 2018-09-29 16:14:14 UTC
Created attachment 79614 [details] [review]
Bug 21454: Update the tests
Comment 2 Jonathan Druart 2018-09-29 16:14:19 UTC
Created attachment 79615 [details] [review]
Bug 21454: Do not require html filter on Price

Test plan:
- Apply first patch
- Confirm that tests is failing (t/template_filters.t)
- Apply second patch
- Confirm that tests return green
- Apply last patch
- Confirm that prices are displayed correctly

QA step:
Edit a template and add the following 2 lines:
[% SET p = '<script>alert("foo");</script>' %]
[% x | $Price %]
=> Display '0.00'
Comment 3 Jonathan Druart 2018-09-29 16:14:23 UTC
Created attachment 79616 [details] [review]
Bug 21454: Remove html filter for Price filtered variables

Generated with:
perl -p -i -e 's/\|\s?\$Price\s?\|\s?html\s%]/| \$Price %]/g' **/*.tt **/*.inc
Comment 4 Kyle M Hall 2018-10-01 11:20:43 UTC
Created attachment 79703 [details] [review]
Bug 21454: Update the tests

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 5 Kyle M Hall 2018-10-01 11:20:53 UTC
Created attachment 79704 [details] [review]
Bug 21454: Do not require html filter on Price

Test plan:
- Apply first patch
- Confirm that tests is failing (t/template_filters.t)
- Apply second patch
- Confirm that tests return green
- Apply last patch
- Confirm that prices are displayed correctly

QA step:
Edit a template and add the following 2 lines:
[% SET p = '<script>alert("foo");</script>' %]
[% x | $Price %]
=> Display '0.00'

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 6 Kyle M Hall 2018-10-01 11:20:56 UTC
Created attachment 79705 [details] [review]
Bug 21454: Remove html filter for Price filtered variables

Generated with:
perl -p -i -e 's/\|\s?\$Price\s?\|\s?html\s%]/| \$Price %]/g' **/*.tt **/*.inc

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 7 Nick Clemens 2018-10-01 13:01:51 UTC
Moving to PQA - reviewed, changes all make sense
Comment 8 Nick Clemens 2018-10-01 16:46:26 UTC
Awesome work all!

Pushed to master for 18.11
Comment 9 Martin Renvoize 2018-10-05 15:53:54 UTC
Dependency not in 18.05.x series.