[Bug 20891] New: Lists in staff don't load when \ was used in the description
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Bug ID: 20891 Summary: Lists in staff don't load when \ was used in the description Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Lists Assignee: koha-bugs@lists.koha-community.org Reporter: katrin.fischer@bsz-bw.de QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl When someone uses \ in the description of a list, the datatable in staff won't load and keeps processing. Tested in 16.11 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 --- Comment #1 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 75887 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=75887&action=edit Bug 20891: Escape list's names in JSON When someone uses \ in the description of a list, the datatable in staff won't load and keeps processing. Test plan: - Create a list named "<script>alert('hola');</script>" - Create another list named "k\o\h\a" - Hit /cgi-bin/koha/virtualshelves/shelves.pl => Without this patch the lists will not be displayed, JSON is malformated => With this patch everything is ok -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |jonathan.druart@bugs.koha-c |ity.org |ommunity.org CC| |jonathan.druart@bugs.koha-c | |ommunity.org -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #75887|0 |1 is obsolete| | --- Comment #2 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 75890 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=75890&action=edit Bug 20891: Escape list's names in JSON When someone uses \ in the description of a list, the datatable in staff won't load and keeps processing. Test plan: - Create a list named "<script>alert('hola');</script>" - Create another list named "k\o\h\a" - Hit /cgi-bin/koha/virtualshelves/shelves.pl => Without this patch the lists will not be displayed, JSON is malformated => With this patch everything is ok Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch Status|Signed Off |Passed QA QA Contact|testopia@bugs.koha-communit |m.de.rooy@rijksmuseum.nl |y.org | --- Comment #3 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Combining SO and QA for trivial patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Failed QA CC| |nick@bywatersolutions.com --- Comment #4 from Nick Clemens <nick@bywatersolutions.com> --- I took your test plant too literally, if your list name is surrounded by quotes: "<script>alert('hola');</script>" it works before this patch, but not after. I think the JSON conversion doesn't like the quotes -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 --- Comment #5 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 75922 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=75922&action=edit Bug 20891: Escape html then JSON To my understanding we need to escape first html chars then to JSON. If this patch works we will need to rethink the 'To' TT plugin. It was originally designed to have several escape methods, but with these changes it will not make sense to name it 'To' if used only to escape JSON IIRC we should keep the 2 different ways to use it: * [% To.json( string ) %] * [% string | $To %] otherwise it will be hard to use it when called in argument of patron-title.inc (`git grep To.json`) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |In Discussion --- Comment #6 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Good catch Nick. From trivial it is becoming a complex one now. Last patch for discussion and review before a full rewrite of the TT plugin. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Josef Moravec <josef.moravec@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |josef.moravec@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 --- Comment #7 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I think we had similar problems on patron search - anything we could pick from there? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 --- Comment #8 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- (In reply to Katrin Fischer from comment #7)
I think we had similar problems on patron search - anything we could pick from there?
We are using the same code for lists and patrons, so I supposed patron's result will explode if '\' is contained in the surname/firstname, which certainly does not exist in a production DB :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 --- Comment #9 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to Jonathan Druart from comment #8)
(In reply to Katrin Fischer from comment #7)
I think we had similar problems on patron search - anything we could pick from there?
We are using the same code for lists and patrons, so I supposed patron's result will explode if '\' is contained in the surname/firstname, which certainly does not exist in a production DB :)
Actually, we had a lot of issues with patron search on migrating a lot of libraries recently. You never know what is in the data you get and it's hard to debug the JSON errors in some cases. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 --- Comment #10 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- (In reply to Katrin Fischer from comment #9)
(In reply to Jonathan Druart from comment #8)
(In reply to Katrin Fischer from comment #7)
I think we had similar problems on patron search - anything we could pick from there?
We are using the same code for lists and patrons, so I supposed patron's result will explode if '\' is contained in the surname/firstname, which certainly does not exist in a production DB :)
Actually, we had a lot of issues with patron search on migrating a lot of libraries recently. You never know what is in the data you get and it's hard to debug the JSON errors in some cases.
open the web dev console, get the answer from the server, copy/paste it on a JSON validator website, and you will know exactly where the problem is. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 --- Comment #11 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- The number of patrons in this libraries is so big that the answer is cut off in the developer tools in the browser... so you have to page until you can limit it to the right 'area'. I am open for ideas ;) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 --- Comment #12 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- We have checked recent migration scripts that we adapted for several problems with patron search. Problematic are afawk: backslash, double quotes, non-printable and for some reason we also have \x11 to ae in there, but not sure if that was just a presentation problem. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 --- Comment #13 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- We've had a similar issue now with the item search where a publisher is spelled with a \ in the name. I think we can't rule \ appearing in real data and for patrons. Can we have another go here? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 --- Comment #14 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Small steps, can we make sure the proposed patches fix the original issue reported? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=22316 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 --- Comment #15 from Fridolin SOMERS <fridolin.somers@biblibre.com> --- I reported in Bug 22369 that combination of To.JSON and |html is wrong for double quotes. JSON converts to \" and then html converts to \" which is a non valid JSON. You may test it also in list description. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 --- Comment #16 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- (In reply to Fridolin SOMERS from comment #15)
I reported in Bug 22369 that combination of To.JSON and |html is wrong for double quotes. JSON converts to \" and then html converts to \" which is a non valid JSON. You may test it also in list description.
Read and tried the patch? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 --- Comment #17 from Fridolin SOMERS <fridolin.somers@biblibre.com> --- (In reply to Jonathan Druart from comment #16)
(In reply to Fridolin SOMERS from comment #15)
I reported in Bug 22369 that combination of To.JSON and |html is wrong for double quotes. JSON converts to \" and then html converts to \" which is a non valid JSON. You may test it also in list description.
Read and tried the patch?
Ha sorry I missed the second patch which looks great. I see this issue as already been spotted in comment 4. The problem is in good hands ;) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=22715 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Liz Rea <wizzyrea@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|In Discussion |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Liz Rea <wizzyrea@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #75890|0 |1 is obsolete| | Attachment #75922|0 |1 is obsolete| | --- Comment #18 from Liz Rea <wizzyrea@gmail.com> --- Created attachment 88637 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=88637&action=edit Bug 20891: Escape list's names in JSON When someone uses \ in the description of a list, the datatable in staff won't load and keeps processing. Test plan: - Create a list named "<script>alert('hola');</script>" - Create another list named "k\o\h\a" - Hit /cgi-bin/koha/virtualshelves/shelves.pl => Without this patch the lists will not be displayed, JSON is malformated => With this patch everything is ok Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Liz Rea <wizzyrea@gmail.com> Resolved minor merge issues, QA plz check they are ok - but it works. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 --- Comment #19 from Liz Rea <wizzyrea@gmail.com> --- Created attachment 88638 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=88638&action=edit Bug 20891: Escape html then JSON To my understanding we need to escape first html chars then to JSON. If this patch works we will need to rethink the 'To' TT plugin. It was originally designed to have several escape methods, but with these changes it will not make sense to name it 'To' if used only to escape JSON IIRC we should keep the 2 different ways to use it: * [% To.json( string ) %] * [% string | $To %] otherwise it will be hard to use it when called in argument of patron-title.inc (`git grep To.json`) Signed-off-by: Liz Rea <wizzyrea@gmail.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 --- Comment #20 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Tested with a little meaner version: <script>alert('hola\');</script>\ Seems to work like a charm! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #88637|0 |1 is obsolete| | --- Comment #21 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 88675 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=88675&action=edit Bug 20891: Escape list's names in JSON When someone uses \ in the description of a list, the datatable in staff won't load and keeps processing. Test plan: - Create a list named "<script>alert('hola');</script>" - Create another list named "k\o\h\a" - Hit /cgi-bin/koha/virtualshelves/shelves.pl => Without this patch the lists will not be displayed, JSON is malformated => With this patch everything is ok Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Liz Rea <wizzyrea@gmail.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #88638|0 |1 is obsolete| | --- Comment #22 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 88676 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=88676&action=edit Bug 20891: Escape html then JSON To my understanding we need to escape first html chars then to JSON. If this patch works we will need to rethink the 'To' TT plugin. It was originally designed to have several escape methods, but with these changes it will not make sense to name it 'To' if used only to escape JSON IIRC we should keep the 2 different ways to use it: * [% To.json( string ) %] * [% string | $To %] otherwise it will be hard to use it when called in argument of patron-title.inc (`git grep To.json`) Signed-off-by: Liz Rea <wizzyrea@gmail.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|minor |normal --- Comment #23 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Updating severity a little bit - broken searches can be quite an issue for the library and are hard to fix without SQL access. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=21716 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |22715 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22715 [Bug 22715] Searching for patrons with "" in the circulation note hangs patron search -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master --- Comment #24 from Nick Clemens <nick@bywatersolutions.com> --- Awesome work all! Pushed to master for 19.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |19.05.00, 18.11.05 released in| | Status|Pushed to Master |Pushed to Stable CC| |martin.renvoize@ptfs-europe | |.com --- Comment #25 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Pushed to 18.11.x for 18.11.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com --- Comment #26 from Lucas Gass <lucas@bywatersolutions.com> --- backported to 18.05.x for 18.05.13 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20891 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Pushed to stable |RESOLVED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org