[Bug 39262] New: shotCartUpdate indirectly uses eval()
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39262 Bug ID: 39262 Summary: shotCartUpdate indirectly uses eval() Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: dcook@prosentient.com.au QA Contact: testopia@bugs.koha-community.org In ./koha-tmpl/opac-tmpl/bootstrap/js/basket.js there is a function "showCartUpdate" which calls the following line: setTimeout("hideCart()", 2000); When you pass a string as the first argument to setTimeout, it performs an eval(). While I don't think there's any security risk in this, it's suboptimal, and it will cause problems when we try to use Content-Security-Policy later. We should just update this to the following: setTimeout(hideCart, 2000); -- There's probably other examples of this, but this is the one that jumped out to me while working on CSP. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39262 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|shotCartUpdate indirectly |showCartUpdate indirectly |uses eval() |uses eval() -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39262 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |oleonard@myacpl.org |ity.org | Status|NEW |ASSIGNED -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39262 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|oleonard@myacpl.org |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39262 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39262 --- Comment #1 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 179078 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179078&action=edit Bug 39262: Don't pass string literals to setTimeout This patch updates a few places in our code where we pass string literals to JavaScript's setTimeout() function. This is not recommended: https://developer.mozilla.org/en-US/docs/Web/API/Window/setTimeout#passing_s... To test, apply the patch and clear your browser cache if necessary. - In the OPAC, perform a catalog search. From the search results page, test adding some items to the cart. The "Item has been added to your cart" message should appear and disappear correctly. - In the staff interface, view the contents of a list. Click the "Print list" button in the toolbar. A new tab should load and trigger the browser's print window. Printing the page or cancelling should automatically close the tab. - Go to Acquisitions -> Vendor -> Basket groups. In the "Open" tab, click the "Close and export as PDF" button. This should trigger a page reload and the creation of a PDF. The basket group should now appear under the "Closed" tab. Sponsored-by: Athens County Public Libraries -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39262 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39262 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179078|0 |1 is obsolete| | --- Comment #2 from David Cook <dcook@prosentient.com.au> --- Created attachment 179137 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179137&action=edit Bug 39262: Don't pass string literals to setTimeout This patch updates a few places in our code where we pass string literals to JavaScript's setTimeout() function. This is not recommended: https://developer.mozilla.org/en-US/docs/Web/API/Window/setTimeout#passing_s... To test, apply the patch and clear your browser cache if necessary. - In the OPAC, perform a catalog search. From the search results page, test adding some items to the cart. The "Item has been added to your cart" message should appear and disappear correctly. - In the staff interface, view the contents of a list. Click the "Print list" button in the toolbar. A new tab should load and trigger the browser's print window. Printing the page or cancelling should automatically close the tab. - Go to Acquisitions -> Vendor -> Basket groups. In the "Open" tab, click the "Close and export as PDF" button. This should trigger a page reload and the creation of a PDF. The basket group should now appear under the "Closed" tab. Sponsored-by: Athens County Public Libraries Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39262 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|dcook@prosentient.com.au |oleonard@myacpl.org --- Comment #3 from David Cook <dcook@prosentient.com.au> --- Thanks for taking care of these, Owen. Much appreciated. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39262 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39262 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179137|0 |1 is obsolete| | --- Comment #4 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 179321 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179321&action=edit Bug 39262: Don't pass string literals to setTimeout This patch updates a few places in our code where we pass string literals to JavaScript's setTimeout() function. This is not recommended: https://developer.mozilla.org/en-US/docs/Web/API/Window/setTimeout#passing_s... To test, apply the patch and clear your browser cache if necessary. - In the OPAC, perform a catalog search. From the search results page, test adding some items to the cart. The "Item has been added to your cart" message should appear and disappear correctly. - In the staff interface, view the contents of a list. Click the "Print list" button in the toolbar. A new tab should load and trigger the browser's print window. Printing the page or cancelling should automatically close the tab. - Go to Acquisitions -> Vendor -> Basket groups. In the "Open" tab, click the "Close and export as PDF" button. This should trigger a page reload and the creation of a PDF. The basket group should now appear under the "Closed" tab. Sponsored-by: Athens County Public Libraries Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39262 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |m.de.rooy@rijksmuseum.nl |y.org | CC| |m.de.rooy@rijksmuseum.nl -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39262 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |25.05.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39262 --- Comment #5 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 25.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39262 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Status|Pushed to main |Needs documenting --- Comment #6 from Fridolin Somers <fridolin.somers@biblibre.com> --- I prefer not impact 24.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39262 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Needs documenting |RESOLVED CC| |david@davidnind.com --- Comment #7 from David Nind <david@davidnind.com> --- Bug fix, no changes to the manual required. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org