Bug 22243 - Advanced Cataloguer editor fails if the target contains an apostrophe in the name
Summary: Advanced Cataloguer editor fails if the target contains an apostrophe in the ...
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Cataloging (show other bugs)
Version: master
Hardware: All All
: P5 - low normal (vote)
Assignee: Andrew Isherwood
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-01-31 09:38 UTC by Andrew Isherwood
Modified: 2021-01-10 00:36 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Text to go in the release notes:
Version(s) released in:
21.05.00,20.11.01,20.05.07


Attachments
Bug 22243: Fix unescaped apostrophe in Z target (1.51 KB, patch)
2019-01-31 09:43 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 22243: Fix unescaped apostrophe in Z target (1.42 KB, patch)
2020-12-17 21:12 UTC, Alexis Ripetti
Details | Diff | Splinter Review
Bug 22243: Fix unescaped apostrophe in Z target (1.49 KB, patch)
2020-12-17 21:54 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 22243: Fix unescaped apostrophe in Z target (1.54 KB, patch)
2020-12-21 14:59 UTC, Nick Clemens
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Andrew Isherwood 2019-01-31 09:38:38 UTC
As the title, if a z39.50 target has an apostrophe in the name, the editor fails with an "Unexpected token" Javascript error. The array containing the targets is constructed then embedded in the page template and, since the string is enclosed in unescaped single apostrophes, things fall over.

The fix is to replace ' in target names with '
Comment 1 Andrew Isherwood 2019-01-31 09:43:12 UTC
Created attachment 84566 [details] [review]
Bug 22243: Fix unescaped apostrophe in Z target

This patch escapes apostrophes in the z39.50 target name prior to them
being embedded in the template.

To test:

- Create a z39.50 target containing an apostrophe in the title
- Note that the Advanced Cataloguer editor does not load
- Apply the patch
- TEST: Note that the Advanced Cataloguer editor does load
Comment 2 Owen Leonard 2019-02-01 17:59:42 UTC
This patch doesn't work for me. What about doing this?

name: '[% server.servername | html_entity %]',

It looks like the html_entity filter is what we want here: http://template-toolkit.org/docs/manual/Filters.html#section_html_entity
Comment 3 Alexis Ripetti 2020-12-17 21:12:22 UTC
Created attachment 114499 [details] [review]
Bug 22243: Fix unescaped apostrophe in Z target

This patch escapes apostrophes in the z39.50 target name prior to them
being embedded in the template.

To test:

- Create a z39.50 target containing an apostrophe in the title
- Note that the Advanced Cataloguer editor does not load
- Apply the patch
- TEST: Note that the Advanced Cataloguer editor does load
Comment 4 Andrew Fuerste-Henry 2020-12-17 21:54:54 UTC
Created attachment 114502 [details] [review]
Bug 22243: Fix unescaped apostrophe in Z target

This patch escapes apostrophes in the z39.50 target name prior to them
being embedded in the template.

To test:

- Create a z39.50 target containing an apostrophe in the title
- Note that the Advanced Cataloguer editor does not load
- Apply the patch
- TEST: Note that the Advanced Cataloguer editor does load

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Comment 5 Nick Clemens 2020-12-21 14:59:32 UTC
Created attachment 114561 [details] [review]
Bug 22243: Fix unescaped apostrophe in Z target

This patch escapes apostrophes in the z39.50 target name prior to them
being embedded in the template.

To test:

- Create a z39.50 target containing an apostrophe in the title
- Note that the Advanced Cataloguer editor does not load
- Apply the patch
- TEST: Note that the Advanced Cataloguer editor does load

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 6 Jonathan Druart 2020-12-26 17:15:01 UTC
Pushed to master for 21.05, thanks to everybody involved!
Comment 7 Fridolin Somers 2020-12-30 14:36:20 UTC
Not sure this was the best way to fix.
There are only a few places with 'html_entity' filter.
Other places use double-quotes for JS strings and html TT filter replaces double-quotes with &quot;
Comment 8 Fridolin Somers 2020-12-30 14:36:52 UTC
Pushed to 20.11.x for 20.11.01
Comment 9 Andrew Fuerste-Henry 2021-01-04 21:44:40 UTC
Pushed to 20.05.x for 20.05.07
Comment 10 Victor Grousset/tuxayo 2021-01-10 00:36:29 UTC
Not backported to oldoldstable (19.11.x). Feel free to ask if it's needed.