Bug 30391 - Bad JavaScript in IntranetUserJS can break the staff interface
Summary: Bad JavaScript in IntranetUserJS can break the staff interface
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Staff interface (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-03-29 06:22 UTC by Magnus Enger
Modified: 2023-06-17 19:58 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Magnus Enger 2022-03-29 06:22:01 UTC
I just had a support case where some bad JS was entered into IntranetUserJS, causing all JS-functionality in the staff client to be non-functional. This affected all Ajax-functionality, like displaying the table of ILL requests. But worst of all: it made it impossible to edit IntranetUserJS to remove the offending code! 

The solution was to log into koha-mysql and empty IntranetUserJS. This made JS functional again, and an edited version of the contents of IntranetUserJS could be put back into place. 

At first I thought this could be fixed by adding a syspref to turn IntranetUserJS off temporarily, but on second thought, I guess that would not work because the syspref editor relies on JS... So not sure there is a simple way to safeguard against this problem, but I thought I'd still throw it out there to see if anyone has a good idea...

The bad JS looked something like this:

$('<br /><h2>Something</h2>').insertAfter(this);
Comment 1 Adam Styles 2022-04-02 11:32:31 UTC
Hi Magnus,

The intranet JS logic is injected into all Staff intranet pages on page load.
This means that any JS added to the Intranet JS text area can possibly disrupt existing Koha JS and related core functionality.

From my experience, using Intranet JS to inject some hot fixed for Koha Intranet staff UI can be useful if used sparingly. I generally run regression tests for my JS added source via a local vanilla test version of Koha, to test for any potential functionality friction, before apply to live/PROD.

A possible long term fix for this potentially disruptive experience, could be to add micro regression tests to run on save of Intranet JS data input field. This would offer the very core testing for the possible logic blocks to things like JQUERY, which is used to power many of the koha UI front end behaviors.

IMHO.

Thoughts?

Adam.