Bug 40030: Escape values when displaying action logs comparison

When viewing the action logs for a system preference change, there is an
option to view a comparison between different log lines for the same
system preference. However, if a system preference value contains HTML
markup (e.g. in IntranetUserJS), the diff text is only escaped on
sections where a change is marked, so unchanged lines containing HTML
markup result in the HTML being rendered.

Escape the string values for unchanged sections as well, to ensure that
HTML markup in the diff text will not be rendered.

To test:
1. Edit IntranetUserJS and add some code that contains HTML markup.
   For example:
$("body").append('<a id="helloworld" class="btn btn-default">Say hi</a>');
2. Save the preference
3. Make another change to IntranetUserJS that does not affect the line
   you just added, and save again to ensure there are at least 2 action
   log lines for comparison
4. Go to Tools > Log viewer
5. Select System Preferences module and Submit
6. Find the log entries for the above two revisions to IntranetUserJS
7. Check the Compare checkboxes on those entries, and click View
   comparison
--> Note that the HTML button is rendered in the comparison
8. Apply patch
9. Clear browser cache and refresh the page
10. Repeat step 7
--> The button is not rendered and the code is displayed as written
11. Make a change to the line you added in step 1 (for example, replace
    "Say hi" with "Say hello")
12. Refresh the page
13. Check the checkboxes for the newest 2 log entries and click View
    comparison to view the diff for that last change
--> Confirm the change is shown correctly - the button is not rendered
    and nothing has been double-escaped

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 78dbb72ce9)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>

koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.js

@@ -59,7 +59,7 @@ function diffString( o, n ) {
         for (n = out.n[i].row + 1; n < out.o.length && out.o[n].text == null; n++ ) {
           pre += '<del>' + escape(out.o[n]) + oSpace[n] + "</del>";
         }
-        str += " " + out.n[i].text + nSpace[i] + pre;
+        str += " " + escape(out.n[i].text) + nSpace[i] + pre;
       }
     }
   }

koha-tmpl/intranet-tmpl/lib/jsdiff/jsdiff.min.js

@@ -7,4 +7,4 @@
  *
  * More Info:
  *  http://ejohn.org/projects/javascript-diff-algorithm/
- */function escape(a){var b=a;return b=b.replace(/&/g,"&amp;"),b=b.replace(/</g,"&lt;"),b=b.replace(/>/g,"&gt;"),b=b.replace(/"/g,"&quot;"),b}function diffString(a,b){a=a.replace(/\s+$/,""),b=b.replace(/\s+$/,"");var c=diff(a==""?[]:a.split(/\s+/),b==""?[]:b.split(/\s+/)),d="",e=a.match(/\s+/g);e==null?e=["\n"]:e.push("\n");var f=b.match(/\s+/g);f==null?f=["\n"]:f.push("\n");if(c.n.length==0)for(var g=0;g<c.o.length;g++)d+="<del>"+escape(c.o[g])+e[g]+"</del>";else{if(c.n[0].text==null)for(b=0;b<c.o.length&&c.o[b].text==null;b++)d+="<del>"+escape(c.o[b])+e[b]+"</del>";for(var g=0;g<c.n.length;g++)if(c.n[g].text==null)d+="<ins>"+escape(c.n[g])+f[g]+"</ins>";else{var h="";for(b=c.n[g].row+1;b<c.o.length&&c.o[b].text==null;b++)h+="<del>"+escape(c.o[b])+e[b]+"</del>";d+=" "+c.n[g].text+f[g]+h}}return d}function randomColor(){return"rgb("+Math.random()*100+"%, "+Math.random()*100+"%, "+Math.random()*100+"%)"}function diffString2(a,b){a=a.replace(/\s+$/,""),b=b.replace(/\s+$/,"");var c=diff(a==""?[]:a.split(/\s+/),b==""?[]:b.split(/\s+/)),d=a.match(/\s+/g);d==null?d=["\n"]:d.push("\n");var e=b.match(/\s+/g);e==null?e=["\n"]:e.push("\n");var f="",g=new Array;for(var h=0;h<c.o.length;h++)g[h]=randomColor(),c.o[h].text!=null?f+='<span style="background-color: '+g[h]+'">'+escape(c.o[h].text)+d[h]+"</span>":f+="<del>"+escape(c.o[h])+d[h]+"</del>";var i="";for(var h=0;h<c.n.length;h++)c.n[h].text!=null?i+='<span style="background-color: '+g[c.n[h].row]+'">'+escape(c.n[h].text)+e[h]+"</span>":i+="<ins>"+escape(c.n[h])+e[h]+"</ins>";return{o:f,n:i}}function diff(a,b){var c=new Object,d=new Object;for(var e=0;e<b.length;e++)c[b[e]]==null&&(c[b[e]]={rows:new Array,o:null}),c[b[e]].rows.push(e);for(var e=0;e<a.length;e++)d[a[e]]==null&&(d[a[e]]={rows:new Array,n:null}),d[a[e]].rows.push(e);for(var e in c)c[e].rows.length==1&&typeof d[e]!="undefined"&&d[e].rows.length==1&&(b[c[e].rows[0]]={text:b[c[e].rows[0]],row:d[e].rows[0]},a[d[e].rows[0]]={text:a[d[e].rows[0]],row:c[e].rows[0]});for(var e=0;e<b.length-1;e++)b[e].text!=null&&b[e+1].text==null&&b[e].row+1<a.length&&a[b[e].row+1].text==null&&b[e+1]==a[b[e].row+1]&&(b[e+1]={text:b[e+1],row:b[e].row+1},a[b[e].row+1]={text:a[b[e].row+1],row:e+1});for(var e=b.length-1;e>0;e--)b[e].text!=null&&b[e-1].text==null&&b[e].row>0&&a[b[e].row-1].text==null&&b[e-1]==a[b[e].row-1]&&(b[e-1]={text:b[e-1],row:b[e].row-1},a[b[e].row-1]={text:a[b[e].row-1],row:e-1});return{o:a,n:b}};
+ */function escape(a){var b=a;return b=b.replace(/&/g,"&amp;"),b=b.replace(/</g,"&lt;"),b=b.replace(/>/g,"&gt;"),b=b.replace(/"/g,"&quot;"),b}function diffString(a,b){a=a.replace(/\s+$/,""),b=b.replace(/\s+$/,"");var c=diff(a==""?[]:a.split(/\s+/),b==""?[]:b.split(/\s+/)),d="",e=a.match(/\s+/g);e==null?e=["\n"]:e.push("\n");var f=b.match(/\s+/g);f==null?f=["\n"]:f.push("\n");if(c.n.length==0)for(var g=0;g<c.o.length;g++)d+="<del>"+escape(c.o[g])+e[g]+"</del>";else{if(c.n[0].text==null)for(b=0;b<c.o.length&&c.o[b].text==null;b++)d+="<del>"+escape(c.o[b])+e[b]+"</del>";for(var g=0;g<c.n.length;g++)if(c.n[g].text==null)d+="<ins>"+escape(c.n[g])+f[g]+"</ins>";else{var h="";for(b=c.n[g].row+1;b<c.o.length&&c.o[b].text==null;b++)h+="<del>"+escape(c.o[b])+e[b]+"</del>";d+=" "+escape(c.n[g].text)+f[g]+h}}return d}function randomColor(){return"rgb("+Math.random()*100+"%, "+Math.random()*100+"%, "+Math.random()*100+"%)"}function diffString2(a,b){a=a.replace(/\s+$/,""),b=b.replace(/\s+$/,"");var c=diff(a==""?[]:a.split(/\s+/),b==""?[]:b.split(/\s+/)),d=a.match(/\s+/g);d==null?d=["\n"]:d.push("\n");var e=b.match(/\s+/g);e==null?e=["\n"]:e.push("\n");var f="",g=new Array;for(var h=0;h<c.o.length;h++)g[h]=randomColor(),c.o[h].text!=null?f+='<span style="background-color: '+g[h]+'">'+escape(c.o[h].text)+d[h]+"</span>":f+="<del>"+escape(c.o[h])+d[h]+"</del>";var i="";for(var h=0;h<c.n.length;h++)c.n[h].text!=null?i+='<span style="background-color: '+g[c.n[h].row]+'">'+escape(c.n[h].text)+e[h]+"</span>":i+="<ins>"+escape(c.n[h])+e[h]+"</ins>";return{o:f,n:i}}function diff(a,b){var c=new Object,d=new Object;for(var e=0;e<b.length;e++)c[b[e]]==null&&(c[b[e]]={rows:new Array,o:null}),c[b[e]].rows.push(e);for(var e=0;e<a.length;e++)d[a[e]]==null&&(d[a[e]]={rows:new Array,n:null}),d[a[e]].rows.push(e);for(var e in c)c[e].rows.length==1&&typeof d[e]!="undefined"&&d[e].rows.length==1&&(b[c[e].rows[0]]={text:b[c[e].rows[0]],row:d[e].rows[0]},a[d[e].rows[0]]={text:a[d[e].rows[0]],row:c[e].rows[0]});for(var e=0;e<b.length-1;e++)b[e].text!=null&&b[e+1].text==null&&b[e].row+1<a.length&&a[b[e].row+1].text==null&&b[e+1]==a[b[e].row+1]&&(b[e+1]={text:b[e+1],row:b[e].row+1},a[b[e].row+1]={text:a[b[e].row+1],row:e+1});for(var e=b.length-1;e>0;e--)b[e].text!=null&&b[e-1].text==null&&b[e].row>0&&a[b[e].row-1].text==null&&b[e-1]==a[b[e].row-1]&&(b[e-1]={text:b[e-1],row:b[e].row-1},a[b[e].row-1]={text:a[b[e].row-1],row:e-1});return{o:a,n:b}};