gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42048: Build patron search description more carefully 

This patch builds the patron search description more carefully
to avoid XSS

Test plan:
0. Apply the patch
1. Log into Koha and click on "Patrons"
2. Change the "Category" and "Library" to any option but "Any"
   and click "Search"
3. Type "test" into the data table "Search:" box
4. Note some text should appear on the screen similar to this content
   and format:

   Patrons found for: Anywhere: test
   Library=Centerville, Category=Board

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
This commit is contained in:
David Cook 2026-03-10 05:21:49 +00:00 committed by Jacob O'Mara
parent f8dbe45221
commit c2869ae136
No known key found for this signature in database
1 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
koha-tmpl/intranet-tmpl/prog/js/datatables.js
View File

@ -1362,7 +1362,7 @@ function update_search_description(
column_searches.push(
"%s=%s".format(
table_dt.column(i).header().innerHTML,
table_dt.column(i).header().textContent,
search
)
);
@ -1374,10 +1374,18 @@ function update_search_description(
if (description.length) {
let display = description.length ? "block" : "none";
let description_str = $(description_node)
.data("prefix")
.format(description.join("<br/>"));
$(description_node).html(description_str).show();
const search_desc_node = $(description_node);
search_desc_node.empty(); //Removing existing child nodes
const prefix = search_desc_node.data("prefix").format("");
search_desc_node.append(prefix);
const last_index = description.length - 1;
description.forEach((item, index) => {
search_desc_node.append(document.createTextNode(item));
if (index !== last_index) {
search_desc_node.append(document.createElement("br"));
}
});
$(description_node).show();
} else {
$(description_node).html("").hide();
}