25c36c5884
When viewing the action logs for a system preference change, there is an
option to view a comparison between different log lines for the same
system preference. However, if a system preference value contains HTML
markup (e.g. in IntranetUserJS), the diff text is only escaped on
sections where a change is marked, so unchanged lines containing HTML
markup result in the HTML being rendered.
Escape the string values for unchanged sections as well, to ensure that
HTML markup in the diff text will not be rendered.
To test:
1. Edit IntranetUserJS and add some code that contains HTML markup.
For example:
$("body").append('<a id="helloworld" class="btn btn-default">Say hi</a>');
2. Save the preference
3. Make another change to IntranetUserJS that does not affect the line
you just added, and save again to ensure there are at least 2 action
log lines for comparison
4. Go to Tools > Log viewer
5. Select System Preferences module and Submit
6. Find the log entries for the above two revisions to IntranetUserJS
7. Check the Compare checkboxes on those entries, and click View
comparison
--> Note that the HTML button is rendered in the comparison
8. Apply patch
9. Clear browser cache and refresh the page
10. Repeat step 7
--> The button is not rendered and the code is displayed as written
11. Make a change to the line you added in step 1 (for example, replace
"Say hi" with "Say hello")
12. Refresh the page
13. Check the checkboxes for the newest 2 log entries and click View
comparison to view the diff for that last change
--> Confirm the change is shown correctly - the button is not rendered
and nothing has been double-escaped
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit
|
||
|---|---|---|
| C4 | ||
| Koha | ||
| acqui | ||
| admin | ||
| api | ||
| authorities | ||
| basket | ||
| bin | ||
| bookings | ||
| catalogue | ||
| cataloguing | ||
| circ | ||
| clubs | ||
| course_reserves | ||
| debian | ||
| docs | ||
| erm | ||
| errors | ||
| etc | ||
| ill | ||
| installer | ||
| koha-tmpl | ||
| labels | ||
| lib | ||
| members | ||
| misc | ||
| offline_circ | ||
| opac | ||
| patron_lists | ||
| patroncards | ||
| plugins | ||
| pos | ||
| preservation | ||
| recalls | ||
| reports | ||
| reserve | ||
| reviews | ||
| rotating_collections | ||
| serials | ||
| services | ||
| skel | ||
| suggestion | ||
| svc | ||
| t | ||
| tags | ||
| tools | ||
| virtualshelves | ||
| xt | ||
| .codespell-ignore | ||
| .editorconfig | ||
| .git-blame-ignore-revs | ||
| .gitignore | ||
| .htaccess | ||
| .mailmap | ||
| .perlcriticrc | ||
| .perltidyrc | ||
| .prettierrc.js | ||
| .proverc.dist | ||
| .stylelintrc.json | ||
| INSTALL | ||
| Koha.pm | ||
| LICENSE | ||
| MANIFEST.SKIP | ||
| Makefile.PL | ||
| README | ||
| README.md | ||
| README.robots | ||
| about.pl | ||
| app.psgi | ||
| build-resources.PL | ||
| changelanguage.pl | ||
| cpanfile | ||
| cypress.config.ts | ||
| eslint.config.mjs | ||
| fix-perl-path.PL | ||
| gulpfile.js | ||
| help.pl | ||
| kohaversion.pl | ||
| mainpage.pl | ||
| package.json | ||
| rewrite-config.PL | ||
| rspack.config.js | ||
| tsconfig.json | ||
| yarn.lock | ||
README.md
Koha is a free software integrated library system (ILS).
Koha is distributed under the GNU GPL version 3 or later.
Note: Koha does not accept pull requests from git hosting sites.
Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.
For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch
The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook
