[Bug 21418] New: Incorrectly filtered markup in staff client lists
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21418 Bug ID: 21418 Summary: Incorrectly filtered markup in staff client lists Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: ASSIGNED Severity: critical Priority: P5 - low Component: Staff Client Assignee: oleonard@myacpl.org Reporter: oleonard@myacpl.org QA Contact: testopia@bugs.koha-community.org CC: bgkriegel@gmail.com, brendan@bywatersolutions.com, chris@bigballofwax.co.nz, dcook@prosentient.com.au, ere.maijala@helsinki.fi, fridolin.somers@biblibre.com, george@nekls.org, gmcharlt@gmail.com, j.kylmala@gmail.com, jonathan.druart@bugs.koha-community.org, julian.maurice@biblibre.com, katrin.fischer@bsz-bw.de, kohadevinim@devinim.com.tr, kyle@bywatersolutions.com, liz@catalyst.net.nz, m.de.rooy@rijksmuseum.nl, martin.renvoize@ptfs-europe.com, mirko@abunchofthings.net, mtompset@hotmail.com, nick@bywatersolutions.com, testopia@bugs.koha-community.org, tomascohen@gmail.com, veron@veron.ch Depends on: 13618 The AJAX DataTable of existing lists is broken because the action buttons are incorrectly rendered. The "| html" filter should be removed from the action_block declarations. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13618 [Bug 13618] Prevent XSS in the Staff Client and the OPAC -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21418 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21418 --- Comment #1 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 79442 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=79442&action=edit Bug 21418: Incorrectly filtered markup in staff client lists This patch removes the "|html" filter from some variable declarations in the template used to display the list of lists in the staff client. To test you should have at least one list. Apply the patch and go to Lists. In the table of lists, the "Edit" and "Delete" buttons should look correct and work correctly. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21418 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA --- Comment #2 from Chris Cormack <chris@bigballofwax.co.nz> --- Hey Owen I'm pretty sure we need to filter everything or the QA scripts will complain, so we should use raw when we don't want html https://wiki.koha-community.org/wiki/Coding_Guidelines#HTML9:_filter_all_the... That way its easy to find unfiltered variables (by mistake) vs ones specifically chosen not to be filtered. If that makes sense? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21418 --- Comment #3 from Owen Leonard <oleonard@myacpl.org> --- But isn't it getting filtered later at line 60? [%~ To.json(action_block) | $raw ~%] -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21418 --- Comment #4 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- If the TT block contains '=' the script/test will not complain, so these changes should be good. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21418 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21418 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #79442|0 |1 is obsolete| | --- Comment #5 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 79610 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=79610&action=edit Bug 21418: Incorrectly filtered markup in staff client lists This patch removes the "|html" filter from some variable declarations in the template used to display the list of lists in the staff client. To test you should have at least one list. Apply the patch and go to Lists. In the table of lists, the "Edit" and "Delete" buttons should look correct and work correctly. Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21418 --- Comment #6 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 79611 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=79611&action=edit Bug 21418: Html escape the 2 variables We should be on the safe side without this patch because shelfnumber and type comes from the DB and are integer or varchar. It may be better to show good examples to start, and escape everything anyway. Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21418 --- Comment #7 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 79612 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=79612&action=edit Bug 21418: Remove shelfoff which is not used No need to add a new line to escape this variable that is never used, better to remove it `git grep shelfoff` will prove that it is not used anywhere else. Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21418 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #79611|0 |1 is obsolete| | Attachment #79612|0 |1 is obsolete| | --- Comment #8 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 79706 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=79706&action=edit Bug 21418: Html escape the 2 variables We should be on the safe side without this patch because shelfnumber and type comes from the DB and are integer or varchar. It may be better to show good examples to start, and escape everything anyway. Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Owen Leonard <oleonard@myacpl.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21418 --- Comment #9 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 79707 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=79707&action=edit Bug 21418: Remove shelfoff which is not used No need to add a new line to escape this variable that is never used, better to remove it `git grep shelfoff` will prove that it is not used anywhere else. Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Owen Leonard <oleonard@myacpl.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21418 Josef Moravec <josef.moravec@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21418 Josef Moravec <josef.moravec@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #79610|0 |1 is obsolete| | Attachment #79706|0 |1 is obsolete| | Attachment #79707|0 |1 is obsolete| | --- Comment #10 from Josef Moravec <josef.moravec@gmail.com> --- Created attachment 79830 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=79830&action=edit Bug 21418: Incorrectly filtered markup in staff client lists This patch removes the "|html" filter from some variable declarations in the template used to display the list of lists in the staff client. To test you should have at least one list. Apply the patch and go to Lists. In the table of lists, the "Edit" and "Delete" buttons should look correct and work correctly. Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Josef Moravec <josef.moravec@gmail.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21418 --- Comment #11 from Josef Moravec <josef.moravec@gmail.com> --- Created attachment 79831 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=79831&action=edit Bug 21418: Html escape the 2 variables We should be on the safe side without this patch because shelfnumber and type comes from the DB and are integer or varchar. It may be better to show good examples to start, and escape everything anyway. Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Josef Moravec <josef.moravec@gmail.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21418 --- Comment #12 from Josef Moravec <josef.moravec@gmail.com> --- Created attachment 79832 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=79832&action=edit Bug 21418: Remove shelfoff which is not used No need to add a new line to escape this variable that is never used, better to remove it `git grep shelfoff` will prove that it is not used anywhere else. Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Josef Moravec <josef.moravec@gmail.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21418 Josef Moravec <josef.moravec@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |josef.moravec@gmail.com QA Contact|testopia@bugs.koha-communit |josef.moravec@gmail.com |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21418 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master --- Comment #13 from Nick Clemens <nick@bywatersolutions.com> --- Awesome work all! Pushed to master for 18.11 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21418 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |RESOLVED Resolution|--- |FIXED --- Comment #14 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Causing bug not in 18.05.x series. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21418 Bug 21418 depends on bug 13618, which changed state. Bug 13618 Summary: Add additional template filter methods and a filter presence test to Koha https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13618 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org