gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Revert "Bug 37720: Prevent XSS in label creator" 

This reverts commit 6b844169fd.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Lucas Gass 2024-09-30 19:05:18 +00:00
parent 6b844169fd
commit 3d8c3cb218
2 changed files with 3 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
C4/Creators/Lib.pm
View File

@ -345,7 +345,8 @@ sub get_label_summary {
$record->{'title'} =~ s/\W*$//; # strip off ugly trailing chars
# FIXME contructing staff interface URLs should be done *much* higher up the stack - for the most part, C4 module code
# should not know that it's part of a web app
$label_summary->{'_summary'} = { title => $record->{title}, author => $record->{author}, biblionumber => $record->{biblionumber} };
$record->{'title'} = '<a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=' . $record->{'biblionumber'} . '"> ' . $record->{'title'} . '</a>';
$label_summary->{'_summary'} = $record->{'title'} . " | " . ($record->{'author'} ? $record->{'author'} : 'N/A');
$label_summary->{'_item_type'} = C4::Context->preference("item-level_itypes") ? $record->{'itype'} : $record->{'itemtype'};
$label_summary->{'_barcode'} = $record->{'barcode'};
$label_summary->{'_item_number'} = $item->{'item_number'};

5
koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt
View File

@ -175,11 +175,8 @@
<td>
[% IF ( text_field.field_name == '_item_type_tbl' ) %]
[% ItemTypes.GetDescription( text_field.field_value ) | html %]
[% ELSIF ( text_field.field_name == '_summary_tbl' ) %]
<a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% text_field.field_value.biblionumber | uri %]">[% text_field.field_value.title | html %]</a>
[% IF text_field.field_value.author %]| [% text_field.field_value.author | html %][% END %]
[% ELSE %]
[% text_field.field_value | html %]
[% text_field.field_value | $raw %]
[% END %]
</td>
[% END %]