[Bug 40164] New: Add Template::Plugin::JSON to handle JSON in Template Toolkit
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 Bug ID: 40164 Summary: Add Template::Plugin::JSON to handle JSON in Template Toolkit Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Notices Assignee: tomascohen@gmail.com Reporter: andrew@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org Prior to Bug 39184, some libraries have been using PERL in their notices to parse JSON data. With PERL disallowed in notices, we need a way to handle JSON using Template Toolkit. https://metacpan.org/pod/Template::Plugin::JSON -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED Component|Notices |Packaging Keywords| |dependency CC| |mtj@kohaaloha.com, | |tomascohen@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Signed Off Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 --- Comment #1 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 183334 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=183334&action=edit Bug 40164: Add Template::Plugin::JSON dependency Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #2 from David Cook <dcook@prosentient.com.au> --- I've taken a look at Template::Plugin::JSON, JSON, and JSON::XS and I think overall this should be OK. There are some security considerations mentioned in JSON::XS, but I don't think it's anything that isn't already a potential problem. I thought about creating a Template::Plugin::XML at one point, but it had too many security issues, so I ended up raising bug 39296 to add a Template plugin that lets you take MARCXML and manipulate it with MARC::Record. You might find that one interesting too. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |39184 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39184 [Bug 39184] Server-side template injection leading to remote code execution -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=39184 Depends on|39184 | --- Comment #3 from David Cook <dcook@prosentient.com.au> --- I added bug 39184 as a dependency but technically it's not. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39184 [Bug 39184] Server-side template injection leading to remote code execution -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #183334|0 |1 is obsolete| | --- Comment #4 from David Cook <dcook@prosentient.com.au> --- Created attachment 183362 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=183362&action=edit Bug 40164: Add Template::Plugin::JSON dependency Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |dcook@prosentient.com.au |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com --- Comment #5 from Jonathan Druart <jonathan.druart@gmail.com> --- I think we should have a test for this. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 --- Comment #6 from David Cook <dcook@prosentient.com.au> --- (In reply to Jonathan Druart from comment #5)
I think we should have a test for this.
Not a bad idea. What do you have in mind? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 --- Comment #7 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- (In reply to Jonathan Druart from comment #5)
I think we should have a test for this.
Do we actually have any test for notices using *any* TT plugin? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 --- Comment #8 from David Cook <dcook@prosentient.com.au> --- (In reply to Tomás Cohen Arazi (tcohen) from comment #7)
(In reply to Jonathan Druart from comment #5)
I think we should have a test for this.
Do we actually have any test for notices using *any* TT plugin?
Touché! I don't know specifically about tests for notices using TT plugins, but we do have some unit tests for home-made TT plugins like t/Koha/Plugins/SafeURL.t, It's not clear to me what we'd be trying to test when bringing in a third-party plugin though. I suppose we could test that the plugin does what we're hoping/wanting/expecting it to do, so that if there is an upstream change we catch it early. But I don't know. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 --- Comment #9 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- (In reply to Tomás Cohen Arazi (tcohen) from comment #7)
(In reply to Jonathan Druart from comment #5)
I think we should have a test for this.
Do we actually have any test for notices using *any* TT plugin?
I agree it would be useful to have a test, using this TT plugin. And document how to use it for end users. The test should help us detect breaking changes in the plugin. I agree with adding them. Maybe in a separate bug. Will try tomorrow at the office -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |25.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 --- Comment #10 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Nice work everyone! Pushed to main for 25.11 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |additional_work_needed Version(s)|25.11.00 | released in| | --- Comment #11 from Jonathan Druart <jonathan.druart@gmail.com> --- Jenkins is failing because of this. No need to use selenium to recreate the problem. https://snipboard.io/50SkDI.jpg -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com Status|Pushed to main |Failed QA --- Comment #12 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Reverted from main, please fix if you'd like it back in. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Passed QA --- Comment #13 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- The dependency is already packaged for the stable branches and the 'koha-staging' repo as well. I think we just didn't patch contron.in. That's usually done in a different report. I patched KTD so it includes our community-packaged version of the required library. Will talk to Mason about getting it pulled without this manual step in KTD. I think it can be de-reverted -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 --- Comment #14 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 183773 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=183773&action=edit Bug 40164: (follow-up) Update debian/control Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 --- Comment #15 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- (In reply to Lucas Gass (lukeg) from comment #12)
Reverted from main, please fix if you'd like it back in.
Done. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|additional_work_needed, | |dependency | Text to go in the| |This patch adds a new release notes| |Template::Toolkit library | |to Koha's dependencies. | |This library, while not | |directly used in Koha, can | |be used in | |Template::Toolkit-driven | |templates to access JSON | |structures (e.g. notices, | |report templates, etc). | | | |A good example is making | |report templates that | |include JSON columns, like | |`background_jobs.data`. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |25.11.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 --- Comment #16 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Nice work everyone! Pushed to main for 25.11 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable Version(s)|25.11.00 |25.11.00,25.05.02 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 --- Comment #17 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Nice work everyone! Pushed to 25.05.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting CC| |fridolin.somers@biblibre.co | |m --- Comment #18 from Fridolin Somers <fridolin.somers@biblibre.com> --- Enhancement not pushed to 24.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=42796 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40164 --- Comment #19 from David Cook <dcook@prosentient.com.au> --- Actually... we probably should've just pushed for using Template::Plugin::JSON::Escape which has already been included in Koha for a very long time :/ -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org