[Bug 28675] New: QOTD broken in 20.05
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 Bug ID: 28675 Summary: QOTD broken in 20.05 Change sponsored?: --- Product: Koha Version: 20.05 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Tools Assignee: koha-bugs@lists.koha-community.org Reporter: lucas@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org To recreate: 1. Go to QOTD tool (/cgi-bin/koha/tools/quotes.pl) 2. Click Add quote 3. A new quote is automatically added with Text & Source of: <input id="quoteSource" type="text" style="height:14px; width:99%" onkeydown="fnClickAddQuote(event,this.parentNode.parentNode)"/> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |victor@tuxayo.net -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |normal Status|NEW |ASSIGNED --- Comment #1 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Thanks, I'll investigate the regression. (I guess the severity is normal?) -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |27942 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27942 [Bug 27942] QOTD: quote CSV uploads may contain JavaScript payloads (XSS) -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 --- Comment #2 from Lucas Gass <lucas@bywatersolutions.com> --- This appears to be caused by this commit: https://git.koha-community.org/gitweb/?p=koha.git;a=commit;h=d810cd63100caf9... -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wainuiwitikapark@catalyst.n | |et.nz -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|20.05 |20.11 --- Comment #3 from Victor Grousset/tuxayo <victor@tuxayo.net> --- It didn't occurred in bug 27942 to test the manual quote addition when backporting ^^" Fridolin: 20.11 is confirmed to be affected. Wainui: 19.11 is very likely to be affected also. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 --- Comment #4 from Victor Grousset/tuxayo <victor@tuxayo.net> --- So. <input> are put in the datatable object by the callback of the "add quote" button. And the display of a cell must not escape them. So if we keep the same logic, we have to escape the text from the server but not the text from the callback of the "add quote" button. One way to do that is by removing the cell escape and escape the data when the ajax request comes back. https://datatables.net/reference/option/ajax in the example: «Manipulate the data returned from the server» So the dataSrc callback look good. But datatables changed it's way to do ajax request so the above doesn't work without changing that. https://datatables.net/manual/server-side#Legacy If doesn't seem we can't process the received data with old datatatable ajax method https://legacy.datatables.net/usage/server-side That's what I've found so far, in case that helps. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|QOTD broken in 20.05 |QOTD broken in 20.11 and | |below -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 --- Comment #5 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Created attachment 122697 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=122697&action=edit Bug 28675: (bug 27942 follow-up) Fix QOTD - add new quote Bug 27942 has been written for master on top of bug 27251, and the code differ a lot from what we have in <= 20.11. This patch is quite ugly but it works, and is certainly the less painful solution to fix stable branches. Feel free to provide an alternative patch. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart+koha@gmail. | |com --- Comment #6 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Patch tested on 20.11.x -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|normal |major Keywords| |rel_20_11_candidate -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #122697|0 |1 is obsolete| | --- Comment #7 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Created attachment 122754 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=122754&action=edit Bug 28675: (bug 27942 follow-up) Fix QOTD - add new quote Bug 27942 has been written for master on top of bug 27251, and the code differ a lot from what we have in <= 20.11. This patch is quite ugly but it works, and is certainly the less painful solution to fix stable branches. Feel free to provide an alternative patch. Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off --- Comment #8 from Victor Grousset/tuxayo <victor@tuxayo.net> --- No error found after some fiddling on 20.05.x which needed a conflict to solve. code looks good. QA script passes on the 20.11 version and the 20.05 one. Above attached is the 20.11 version (not the one with the 20.05 conflict solving which would have hindered the applicability on 20.11) So, stamped! -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |victor@tuxayo.net |y.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #122754|0 |1 is obsolete| | --- Comment #9 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 122760 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=122760&action=edit Bug 28675: (bug 27942 follow-up) Fix QOTD - add new quote Bug 27942 has been written for master on top of bug 27251, and the code differ a lot from what we have in <= 20.11. This patch is quite ugly but it works, and is certainly the less painful solution to fix stable branches. Feel free to provide an alternative patch. Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to stable --- Comment #10 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Sending to 20.11 queue. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 --- Comment #11 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- @Frido can still still be pushed for 20.11.08? I just tested and this bug affects 20.11.07. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable Version(s)| |20.11.09 released in| | --- Comment #12 from Fridolin Somers <fridolin.somers@biblibre.com> --- Patch pushed to 20.11.x for 20.11.09 Thanks a lot to all. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldstable |Pushed to oldoldstable Version(s)|20.11.09 |20.11.09,20.05.15 released in| | --- Comment #13 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Backported: Pushed to 20.05.x branch for 20.05.15 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 --- Comment #14 from wainuiwitikapark@catalyst.net.nz --- Should this be backported to 19.11.x for 19.11.21? Or if it contains string changes, backported to 19.11.22? As we are currently in a string freeze. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 --- Comment #15 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- (In reply to wainuiwitikapark from comment #14)
Should this be backported to 19.11.x for 19.11.21?
If it's broken in 19.11 you should backport it for the next one. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 --- Comment #16 from wainuiwitikapark@catalyst.net.nz --- It is broken in 19.11 so will backport it. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 wainuiwitikapark@catalyst.net.nz changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|20.11.09,20.05.15 |20.11.09,20.05.15,19.11.21 released in| | Status|Pushed to oldoldstable |Pushed to oldoldoldstable --- Comment #17 from wainuiwitikapark@catalyst.net.nz --- Backported to 19.11.x for 19.11.21 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28675 Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldoldoldstable |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org