Bug 42471: [25.05] Prevent XSS in suggestion.tt
escape_str all the things Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
This commit is contained in:
Jonathan Druart
Wainui Witika-Park
parent
d413403825
commit
c0ce4d57cd
|
|
@ -1345,7 +1345,7 @@
|
|||
searchable: false,
|
||||
orderable: false,
|
||||
render: function (data, type, row, meta) {
|
||||
return '<input type="checkbox" value="%s" name="suggestionid" />'.format(row.suggestion_id);
|
||||
return '<input type="checkbox" value="%s" name="suggestionid" />'.format(escape_str(row.suggestion_id));
|
||||
}
|
||||
},
|
||||
{
|
||||
|
|
@ -1353,19 +1353,19 @@
|
|||
searchable: true,
|
||||
orderable: true,
|
||||
render: function (data, type, row, meta) {
|
||||
let node = '<a href="suggestion.pl?suggestionid=%s&op=show" title="%s">%s'.format(row.suggestion_id, _("suggestion"), row.title);
|
||||
if(row.author) node += ', by %s'.format(row.author);
|
||||
let node = '<a href="suggestion.pl?suggestionid=%s&op=show" title="%s">%s'.format(escape_str(row.suggestion_id), escape_str(_("suggestion")), escape_str(row.title));
|
||||
if(row.author) node += ', by %s'.format(escape_str(row.author));
|
||||
node += '</a><br />';
|
||||
if(row.copyright_date) node += ' © <span class="suggestion_copyrightdate">%s</span>'.format(row.copyright_date);
|
||||
if(row.volume_desc) node += '; <span class="suggestion_volume">%s:<em>%s</em></span>'.format(_("Volume"), row.volume_desc);
|
||||
if(row.isbn) node += '; <span class="suggestion_isbn">%s:<em>%s</em></span>'.format(_("ISBN"), row.isbn);
|
||||
if(row.publisher_code) node += '; <span class="suggestion_publishercode">%s %s</span>'.format(_("Published by"), row.publisher_code);
|
||||
if(row.publication_year && row.publication_year != 0) node += '; <span class="suggestion_publicationyear"><em>%s</em></span>'.format(row.publication_year);
|
||||
if(row.publication_place) node += '; <span class="suggestion_place"><em>%s</em></span>'.format(row.publication_place);
|
||||
if(row.collection_title) node += '; <span class="suggestion_collectiontitle"><em>%s</em></span>'.format(row.collection_title);
|
||||
if(row.item_type && row._strings.item_type.str) node += '; <span class="suggestion_itype"><em>%s</em></span>'.format(row._strings.item_type.str);
|
||||
if(row.note) node += '<div class="suggestion_note">%s</div>'.format(row.note);
|
||||
if(row.archived) node += '<br /><i class="fa fa-archive"></i> %s'.format(_("Archived"));
|
||||
if(row.copyright_date) node += ' © <span class="suggestion_copyrightdate">%s</span>'.format(escape_str(row.copyright_date));
|
||||
if(row.volume_desc) node += '; <span class="suggestion_volume">%s:<em>%s</em></span>'.format(escape_str(_("Volume")), escape_str(row.volume_desc));
|
||||
if(row.isbn) node += '; <span class="suggestion_isbn">%s:<em>%s</em></span>'.format(escape_str(_("ISBN")), escape_str(row.isbn));
|
||||
if(row.publisher_code) node += '; <span class="suggestion_publishercode">%s %s</span>'.format(escape_str(_("Published by")), escape_str(row.publisher_code));
|
||||
if(row.publication_year && row.publication_year != 0) node += '; <span class="suggestion_publicationyear"><em>%s</em></span>'.format(escape_str(row.publication_year));
|
||||
if(row.publication_place) node += '; <span class="suggestion_place"><em>%s</em></span>'.format(escape_str(row.publication_place));
|
||||
if(row.collection_title) node += '; <span class="suggestion_collectiontitle"><em>%s</em></span>'.format(escape_str(row.collection_title));
|
||||
if(row.item_type && row._strings.item_type.str) node += '; <span class="suggestion_itype"><em>%s</em></span>'.format(escape_str(row._strings.item_type.str));
|
||||
if(row.note) node += '<div class="suggestion_note">%s</div>'.format(escape_str(row.note));
|
||||
if(row.archived) node += '<br /><i class="fa fa-archive"></i> %s'.format(escape_str(_("Archived")));
|
||||
return node;
|
||||
}
|
||||
},
|
||||
|
|
@ -1376,9 +1376,9 @@
|
|||
render: function (data, type, row, meta) {
|
||||
let suggester = row.suggester;
|
||||
if(suggester) {
|
||||
let node = '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=%s">%s'.format(suggester.patron_id, suggester.surname);
|
||||
if(suggester.firstname) node += ', %s'.format(suggester.firstname);
|
||||
if(suggester.cardnumber) node += ' (%s)'.format(suggester.cardnumber);
|
||||
let node = '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=%s">%s'.format(escape_str(suggester.patron_id), escape_str(suggester.surname));
|
||||
if(suggester.firstname) node += ', %s'.format(escape_str(suggester.firstname));
|
||||
if(suggester.cardnumber) node += ' (%s)'.format(escape_str(suggester.cardnumber));
|
||||
node += '</a>';
|
||||
return node;
|
||||
}
|
||||
|
|
@ -1415,8 +1415,8 @@
|
|||
orderable: true,
|
||||
render: function (data, type, row, meta) {
|
||||
if(row.manager) {
|
||||
let node = '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=%s">%s'.format(row.manager?.patron_id, row.manager?.surname);
|
||||
if(row.manager?.firstname) node += ', %s'.format(row.manager?.firstname);
|
||||
let node = '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=%s">%s'.format(escape_str(row.manager?.patron_id), escape_str(row.manager?.surname));
|
||||
if(row.manager?.firstname) node += ', %s'.format(escape_str(row.manager?.firstname));
|
||||
node += '</a>';
|
||||
return node;
|
||||
}
|
||||
|
|
@ -1436,10 +1436,10 @@
|
|||
searchable: true,
|
||||
orderable: true,
|
||||
render: function (data, type, row, meta) {
|
||||
if(row.last_modifier) {
|
||||
let node = '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=%s">%s'.format(row.last_modifier?.patron_id, row.last_modifier?.surname);
|
||||
if(row.last_modifier?.firstname) node += ', %s'.format(row.last_modifier?.firstname);
|
||||
node += '</a>';
|
||||
if (row.last_modifier) {
|
||||
let node = '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=%s">%s'.format(escape_str(row.last_modifier?.patron_id), escape_str(row.last_modifier?.surname));
|
||||
if (row.last_modifier?.firstname) node += ", %s".format(escape_str(row.last_modifier?.firstname));
|
||||
node += "</a>";
|
||||
return node;
|
||||
}
|
||||
return ''
|
||||
|
|
@ -1490,17 +1490,17 @@
|
|||
searchable: true,
|
||||
orderable: true,
|
||||
render: function (data, type, row, meta) {
|
||||
let node = '';
|
||||
if(row.status === 'ASKED') node += '<span class="status asked">%s</span>'.format(_("Pending"));
|
||||
else if(row.status === 'ACCEPTED') node += '<span class="status accepted">%s</span>'.format(_("Accepted"));
|
||||
else if(row.status === 'ORDERED') node += '<span class="status ordered">%s</span>'.format(_("Ordered"));
|
||||
else if(row.status === 'REJECTED') node += '<span class="status rejected">%s</span>'.format(_("Rejected"));
|
||||
else if(row.status === 'CHECKED') node += '<span class="status checked">%s</span>'.format(_("Checked"));
|
||||
else if(row.status === 'AVAILABLE') node += '<span class="status available">%s</span>'.format(_("Available"));
|
||||
else if(row._strings.status.str) node += '<span class="status '+ row.status +'">%s</span>'.format(row._strings.status.str);
|
||||
else node += '<span class="status unknown">%s</span>'.format(_("Status unknown"));
|
||||
if ( row.reason ) {
|
||||
node += '<div class="reason" data-reason="'+row.reason+'">('+ row.reason +')</div>';
|
||||
let node = "";
|
||||
if (row.status === "ASKED") node += '<span class="status asked">%s</span>'.format(escape_str(_("Pending")));
|
||||
else if (row.status === "ACCEPTED") node += '<span class="status accepted">%s</span>'.format(escape_str(_("Accepted")));
|
||||
else if (row.status === "ORDERED") node += '<span class="status ordered">%s</span>'.format(escape_str(_("Ordered")));
|
||||
else if (row.status === "REJECTED") node += '<span class="status rejected">%s</span>'.format(escape_str(_("Rejected")));
|
||||
else if (row.status === "CHECKED") node += '<span class="status checked">%s</span>'.format(escape_str(_("Checked")));
|
||||
else if (row.status === "AVAILABLE") node += '<span class="status available">%s</span>'.format(escape_str(_("Available")));
|
||||
else if (row._strings.status.str) node += '<span class="status ' + escape_str(row.status) + '">%s</span>'.format(escape_str(row._strings.status.str));
|
||||
else node += '<span class="status unknown">%s</span>'.format(escape_str(_("Status unknown")));
|
||||
if (row.reason) {
|
||||
node += '<div class="reason" data-reason="' + escape_str(row.reason) + '">(' + escape_str(row.reason) + ")</div>";
|
||||
}
|
||||
return node;
|
||||
},
|
||||
|
|
@ -1512,21 +1512,21 @@
|
|||
render: function (data, type, row, meta) {
|
||||
[% IF CAN_user_suggestions_suggestions_manage %]
|
||||
let node = '<div class="btn-group dropup">'
|
||||
node += '<a class="btn btn-default btn-xs" role="button" href="suggestion.pl?suggestionid=%s&op=edit_form"><i class="fa-solid fa-pencil" aria-hidden="true"></i> %s</a>'.format(row.suggestion_id, _("Edit"))
|
||||
node += '<a class="btn btn-default btn-xs dropdown-toggle" id="more_actions_%s" role="button" data-bs-toggle="dropdown" href="#"><b class="caret"></b></a>'.format(row.suggestion_id)
|
||||
node += '<ul class="dropdown-menu" role="menu" aria-labelledby="more_actions_%s">'.format(row.suggestion_id)
|
||||
node += '<a class="btn btn-default btn-xs" role="button" href="suggestion.pl?suggestionid=%s&op=edit_form"><i class="fa-solid fa-pencil" aria-hidden="true"></i> %s</a>'.format(escape_str(row.suggestion_id), escape_str(_("Edit")))
|
||||
node += '<a class="btn btn-default btn-xs dropdown-toggle" id="more_actions_%s" role="button" data-bs-toggle="dropdown" href="#"><b class="caret"></b></a>'.format(escape_str(row.suggestion_id))
|
||||
node += '<ul class="dropdown-menu" role="menu" aria-labelledby="more_actions_%s">'.format(escape_str(row.suggestion_id))
|
||||
[% IF CAN_user_suggestions_suggestions_delete %]
|
||||
node += '<li><a href="#" data-op="cud-delete" data-suggestionid="%s" class="dropdown-item trigger_action">%s</a></li>'.format(row.suggestion_id, _("Delete"))
|
||||
node += '<li><a href="#" data-op="cud-delete" data-suggestionid="%s" class="dropdown-item trigger_action">%s</a></li>'.format(escape_str(row.suggestion_id), escape_str(_("Delete")))
|
||||
[% END %]
|
||||
if (!row.archived){
|
||||
node += '<li><a href="#" class="dropdown-item trigger_action" data-op="cud-archive" data-suggestionid="%s">%s</a></li>'.format(row.suggestion_id, _("Archive"))
|
||||
node += '<li><a href="#" class="dropdown-item trigger_action" data-op="cud-archive" data-suggestionid="%s">%s</a></li>'.format(escape_str(row.suggestion_id), escape_str(_("Archive")))
|
||||
} else {
|
||||
node += '<li><a href="#" class="dropdown-item trigger_action" data-op="cud-unarchive" data-suggestionid="%s">%s</a></li>'.format(row.suggestion_id, _("Unarchive"))
|
||||
node += '<li><a href="#" class="dropdown-item trigger_action" data-op="cud-unarchive" data-suggestionid="%s">%s</a></li>'.format(escape_str(row.suggestion_id), escape_str(_("Unarchive")))
|
||||
}
|
||||
node += '</ul></div>'
|
||||
return node
|
||||
[% ELSIF CAN_user_suggestions_suggestions_delete %]
|
||||
return '<button data-op="cud-delete" data-suggestionid="%s" class="btn btn-xs btn-default trigger_action"><i class="fa fa-trash-can"></i> %s</button>'.format(row.suggestion_id, _("Delete"))
|
||||
return '<button data-op="cud-delete" data-suggestionid="%s" class="btn btn-xs btn-default trigger_action"><i class="fa fa-trash-can"></i> %s</button>'.format(escape_str(row.suggestion_id), escape_str(_("Delete")()
|
||||
[% END %]
|
||||
},
|
||||
createdCell: function (cell, cellData, rowData, rowIndex, colIndex) {
|
||||
|
|
|
|||
Loading…
Reference in New Issue