gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42254: (follow-up) tweaks to improve XSS fix 

This change removes useless success_* calls, removes an unnecessary
'use URI::Escape qw( uri_unescape );' in the Perl, adds a missing
response function argument, uses a safe sink for the "verdict" element
to make the content setting a bit cleaner.

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
This commit is contained in:
David Cook 2026-04-07 03:07:42 +00:00 committed by Jacob O'Mara
parent 7b5dcca344
commit 1218a44ddf
No known key found for this signature in database
2 changed files with 35 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js
View File

@ -14,9 +14,9 @@ function pull_counts () {
rej_count = parseInt(document.getElementById("terms_summary_rejected_count" ).innerHTML);
}
function count_approve() {
function count_approve(response) {
if (response.status == "success") {
success_approve(response.tag);
//success_approve(response.tag);
} else {
failure_approve(response.tag);
}
@ -29,7 +29,7 @@ function count_approve() {
function count_reject(response) {
if (response.status == "success") {
success_reject(response.tag);
//success_reject(response.tag);
} else {
failure_reject(response.tag);
}
@ -40,28 +40,37 @@ function count_reject(response) {
}
}
var success_approve = function(tag){
// window.alert(__("AJAX approved tag: ") + tag);
};
//var success_approve = function (tag) {
// window.alert(__("AJAX approved tag: ") + tag);
//};
var failure_approve = function (tag) {
window.alert(__("AJAX failed to approve tag: %s").format(escape_str(tag)));
};
var success_reject = function(tag){
// window.alert(__("AJAX rejected tag: ") + tag);
};
//var success_reject = function (tag) {
// window.alert(__("AJAX rejected tag: ") + tag);
//};
var failure_reject = function (tag) {
window.alert(__("AJAX failed to reject tag: %s").format(escape_str(tag)));
};
var success_test = function (tag) {
$("#verdict").html(__("%s is permitted!").format(escape_str(tag)));
const verdict = document.querySelector("#verdict");
if (verdict) {
verdict.textContent = __("%s is permitted!").format(tag);
}
};
var failure_test = function (tag) {
$("#verdict").html(__("%s is prohibited!").format(escape_str(tag)));
const verdict = document.querySelector("#verdict");
if (verdict) {
verdict.textContent = __("%s is prohibited!").format(tag);
}
};
var indeterminate_test = function (tag) {
$("#verdict").html(
__("%s is neither permitted nor prohibited!").format(escape_str(tag))
);
const verdict = document.querySelector("#verdict");
if (verdict) {
verdict.textContent = __(
"%s is neither permitted nor prohibited!"
).format(tag);
}
};
var success_test_call = function (response) {

23
tags/review.pl
View File

@ -23,9 +23,8 @@ use Modern::Perl;
use POSIX qw( ceil );
use CGI qw ( -utf8 );
use CGI::Cookie; # need to check cookies before having CGI parse the POST request
use URI::Escape qw( uri_unescape );
use JSON qw(encode_json);
use C4::Auth qw( check_cookie_auth get_template_and_user );
use JSON qw(encode_json);
use C4::Auth qw( check_cookie_auth get_template_and_user );
use C4::Context;
use C4::Output qw( output_with_http_headers is_ajax pagination_bar output_html_with_http_headers );
use C4::Tags qw(
@ -39,13 +38,15 @@ use C4::Tags qw(
my $script_name = "/cgi-bin/koha/tags/review.pl";
my $needed_flags = { tools => 'moderate_tags' }; # FIXME: replace when more specific permission is created.
sub ajax_auth_cgi { # returns CGI object
my $needed_flags = shift;
my %cookies = CGI::Cookie->fetch;
my $input = CGI->new;
my $sessid = $cookies{'CGISESSID'}->value;
my ($auth_status) = check_cookie_auth($sessid, $needed_flags);
if ($auth_status ne "ok") {
sub ajax_auth_cgi { # returns CGI object
my $needed_flags = shift;
my %cookies = CGI::Cookie->fetch;
my $input = CGI->new;
my $sessid = $cookies{'CGISESSID'}->value;
my ($auth_status) = check_cookie_auth( $sessid, $needed_flags );
if ( $auth_status ne "ok" ) {
#FIMXE: This should return a HTTP error and not a script
output_with_http_headers $input, undef,
"window.alert('Your CGI session cookie ($sessid) is not current. " .
"Please refresh the page and try again.');\n", 'js';
@ -73,7 +74,7 @@ if (is_ajax()) {
status => $status,
tag => $tag,
};
output_with_http_headers $input, undef, encode_json($response), 'js';
output_with_http_headers $input, undef, encode_json($response), 'json';
exit;
}