[Bug 9411] New: Multiple uses of javascript eval on ajax responses in acq.js
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9411 Bug ID: 9411 Summary: Multiple uses of javascript eval on ajax responses in acq.js Classification: Unclassified Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Acquisitions Assignee: koha-bugs@lists.koha-community.org Reporter: hugh@davenport.net.nz hugh@hugh-desktop:~/code/koha (master)$ cat koha-tmpl/intranet-tmpl/prog/en/js/acq.js | grep eval // rc = eval ( xmlhttp.responseText ); actTotal = eval ( xmlhttp.responseText ); var result = eval ( xmlhttp.responseText ); var result = eval ( xmlhttp.responseText ); hugh@hugh-desktop:~/code/koha (master)$ -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9411 --- Comment #1 from Hugh Davenport <hugh@davenport.net.nz> --- A brief look tells me that it is checking for numerical types, which would be better suited by parseInt and parseFloat -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9411 Hugh Davenport <hugh@davenport.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|normal |major -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9411 Hugh Davenport <hugh@davenport.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED Assignee|koha-bugs@lists.koha-commun |hugh@davenport.net.nz |ity.org | --- Comment #2 from Hugh Davenport <hugh@davenport.net.nz> --- fixing -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9411 Hugh Davenport <hugh@davenport.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9411 Hugh Davenport <hugh@davenport.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9411 --- Comment #3 from Hugh Davenport <hugh@davenport.net.nz> --- Created attachment 14648 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=14648&action=edit bug 9411 Fix javascript evals to use parseInt and parseFloat The acq.js file used evals to parse the return text of ajax queries to determine what result to return. This is a bad thing, and can potentially cause security risks. This patch converts those eval calls to parseInt and parseFloat calls. Note: This patch depends on the patch in bug 4437 so there are no conflicts. Signed-off-by: Hugh Davenport <hugh@davenport.net.nz> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9411 Hugh Davenport <hugh@davenport.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #14648|0 |1 is obsolete| | --- Comment #4 from Hugh Davenport <hugh@davenport.net.nz> --- Created attachment 14650 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=14650&action=edit bug 9411 Fix javascript evals to use parseInt and parseFloat The acq.js file used evals to parse the return text of ajax queries to determine what result to return. This is a bad thing, and can potentially cause security risks. This patch converts those eval calls to parseInt and parseFloat calls. Note: This patch depends on the patch in bug 4437 so there are no conflicts. Signed-off-by: Hugh Davenport <hugh@davenport.net.nz> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9411 Hugh Davenport <hugh@davenport.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|Trivial patch |Small patch -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9411 Hugh Davenport <hugh@davenport.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #14650|0 |1 is obsolete| | --- Comment #5 from Hugh Davenport <hugh@davenport.net.nz> --- Created attachment 14652 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=14652&action=edit bug 4439 Change some helper files to use C4::Service Depends on bug 4437 to avoid conflicts Depends on bug 9412 for a new feature used Also fixes bug 9411 Signed-off-by: Hugh Davenport <hugh@davenport.net.nz> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9411 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kyle@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9411 --- Comment #6 from Kyle M Hall <kyle@bywatersolutions.com> --- Hugh, just a note, the patches you are submitting appear to each have a sign-off line from yourself. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9411 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |chris@bigballofwax.co.nz --- Comment #7 from Chris Cormack <chris@bigballofwax.co.nz> --- Yep, that's quite common in a lot of projects, you'll notice Galen does it also. It means they have tested it themselves. Still needs an external sign off of course. In fact just the other day Galen remarked something like "when did we stop adding a sign off to our patches?" -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9411 --- Comment #8 from Kyle M Hall <kyle@bywatersolutions.com> --- Hugh, can you add a test plan to the patches comments? -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9411 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA --- Comment #9 from Owen Leonard <oleonard@myacpl.org> --- Failing QA pending the addition of a test plan. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9411 --- Comment #10 from Hugh Davenport <hugh@davenport.net.nz> --- Hey Kyle/Owen, What would the format of a test plan be? Cheers, Hugh -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9411 --- Comment #11 from Kyle M Hall <kyle@bywatersolutions.com> --- Since the patch in question doesn't change the behavior of Koha ( at least in theory ) it would be as simple as 1) Perform some action that tests the code to be modified 2) Apply this patch 3) Perform the same action, ensure everything still works the same. What that the action or actions are, is up to you. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9411 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@biblibre.co | |m --- Comment #12 from Jonathan Druart <jonathan.druart@biblibre.com> --- Hugh, Any chances to see this resubmitted? -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9411 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |veron@veron.ch --- Comment #13 from Marc Véron <veron@veron.ch> --- Is this bug still valid? (Does not apply). -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org