https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43137 --- Comment #37 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Hi, Martin. Thanks for the input! (In reply to Martin Renvoize (ashimema) from comment #31)
Comment on attachment 202440 [details] [review] Bug 43137: Add health status boxes to System information tab
Review of attachment 202440 [details] [review]: -----------------------------------------------------------------
::: koha-tmpl/intranet-tmpl/prog/en/modules/about.tt @@ +157,5 @@
+ var plugin = data.plugins[pluginClass]; + if (plugin.checks && plugin.checks.length) { + html += "<h3>"; + if (plugin.url) { + html += '<a href="' + plugin.url + '">' + escapeHtml(plugin.name) + "</a>";
We introduce a xss vector here, we need to properly escape plugin.url in the href concatenation
Should be solved. Happy to review if not the best approach.
@@ +254,5 @@
+ template = template.format(alert.params.unassigned_shards);
I think we also need to add escaping here?
It's a string that comes from ES but I believe it should've been escaped. Solved! (In reply to Martin Renvoize (ashimema) from comment #32)
+ $icon.css("color", "#e74c3c");
Hmm, shouldn't this be in the scss and use a class instead?
Yeah, it smelled to me when I added. I used `tags-review.js` as a reference. Solved! -- You are receiving this mail because: You are watching all bug changes.