<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-AU link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal>Hi all:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>It looks like we’re not validating the data that goes into “cardnumber”. This causes problems in at least one spot (in members-toolbar.inc, which is loaded by circulation.pl). <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>If the cardnumber contains an apostrophe, you’ll get an Uncaught SyntaxError in the javascript function confirm_reregistration.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Unfortunately, using the “uri” filter won’t fix this problem:<br><br>“As of version 2.26 of the Template Toolkit, the uri and url filters use the unsafe character set defined by RFC3986. This means that certain characters ("(", ")", "~", "*", "!" and the single quote "'") are now deemed unsafe and will be escaped as hex character sequences. The double quote character ('"') is now deemed safe and will not be escaped” (<a href="http://template-toolkit.org/docs/manual/Filters.html#section_uri">http://template-toolkit.org/docs/manual/Filters.html#section_uri</a>).<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The required version in Koha is 2.22 and the version in Debian appears to be 2.24. I’m currently using 2.25.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>So I’m not really sure where to go from here but here are some ideas:<br><br>1) Upgrade Template Toolkit to 2.26 (possibly not so easy from a Debian perspective [Robin might want to chime in on that one], and who knows what else has been changed between 2.24 and 2.26? The readme on Github isn’t super comprehensive https://github.com/abw/Template2)<br>2) Replace the single quote in the template with an encoded single quote (not very elegant and possibly a bit annoying to maintain)<o:p></o:p></p><p class=MsoNormal>3) URI encode the data in the .pm or .pl (I rather not handle display template logic in the actual Perl. Plus, cardnumber is passed opaquely to the template via “$template->param(%$borrower);” at the moment)<o:p></o:p></p><p class=MsoNormal>4) Limit the data allowed as a cardnumber (this is probably the hardest thing to do because a borrower can be created in a few different ways… which might make reporting data validation errors more or less difficult…)<o:p></o:p></p><p class=MsoNormal>5) We could write our own Template Toolkit Filter class that escapes the most comprehensively<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>What does the Koha brain trust think?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='mso-fareast-language:EN-AU'>David Cook<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-AU'>Systems Librarian<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-AU'>Prosentient Systems<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-AU'>72/330 Wattle St, Ultimo, NSW 2007<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>