gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42254: (follow-up) tweaks to improve XSS fix 

This change removes useless success_* calls, removes an unnecessary
'use URI::Escape qw( uri_unescape );' in the Perl, adds a missing
response function argument, uses a safe sink for the "verdict" element
to make the content setting a bit cleaner.

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
David Cook 2026-04-07 03:07:42 +00:00 committed by Lucas Gass
parent 822cd31930
commit 517edc11a8
No known key found for this signature in database
GPG Key ID: 60B447398B0D36CA
2 changed files with 28 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js
View File

@ -20,9 +20,9 @@ function pull_counts() {
); );
} }
function count_approve() { function count_approve(response) {
if (response.status == "success") { if (response.status == "success") {
success_approve(response.tag); //success_approve(response.tag);
} else { } else {
failure_approve(response.tag); failure_approve(response.tag);
} }
@ -35,7 +35,7 @@ function count_approve() {
function count_reject(response) { function count_reject(response) {
if (response.status == "success") { if (response.status == "success") {
success_reject(response.tag); //success_reject(response.tag);
} else { } else {
failure_reject(response.tag); failure_reject(response.tag);
} }
@ -46,28 +46,37 @@ function count_reject(response) {
} }
} }
var success_approve = function (tag) { //var success_approve = function (tag) {
// window.alert(__("AJAX approved tag: ") + tag); // window.alert(__("AJAX approved tag: ") + tag);
}; //};
var failure_approve = function (tag) { var failure_approve = function (tag) {
window.alert(__("AJAX failed to approve tag: %s").format(escape_str(tag))); window.alert(__("AJAX failed to approve tag: %s").format(escape_str(tag)));
}; };
var success_reject = function (tag) { //var success_reject = function (tag) {
// window.alert(__("AJAX rejected tag: ") + tag); // window.alert(__("AJAX rejected tag: ") + tag);
}; //};
var failure_reject = function (tag) { var failure_reject = function (tag) {
window.alert(__("AJAX failed to reject tag: %s").format(escape_str(tag))); window.alert(__("AJAX failed to reject tag: %s").format(escape_str(tag)));
}; };
var success_test = function (tag) { var success_test = function (tag) {
$("#verdict").html(__("%s is permitted!").format(escape_str(tag))); const verdict = document.querySelector("#verdict");
if (verdict) {
verdict.textContent = __("%s is permitted!").format(tag);
}
}; };
var failure_test = function (tag) { var failure_test = function (tag) {
$("#verdict").html(__("%s is prohibited!").format(escape_str(tag))); const verdict = document.querySelector("#verdict");
if (verdict) {
verdict.textContent = __("%s is prohibited!").format(tag);
}
}; };
var indeterminate_test = function (tag) { var indeterminate_test = function (tag) {
$("#verdict").html( const verdict = document.querySelector("#verdict");
__("%s is neither permitted nor prohibited!").format(escape_str(tag)) if (verdict) {
); verdict.textContent = __(
"%s is neither permitted nor prohibited!"
).format(tag);
}
}; };
var success_test_call = function (response) { var success_test_call = function (response) {

9
tags/review.pl
View File

@ -23,9 +23,8 @@ use Modern::Perl;
use POSIX qw( ceil ); use POSIX qw( ceil );
use CGI qw ( -utf8 ); use CGI qw ( -utf8 );
use CGI::Cookie; # need to check cookies before having CGI parse the POST request use CGI::Cookie; # need to check cookies before having CGI parse the POST request
use URI::Escape qw( uri_unescape ); use JSON qw(encode_json);
use JSON qw(encode_json); use C4::Auth qw( check_cookie_auth get_template_and_user );
use C4::Auth qw( check_cookie_auth get_template_and_user );
use C4::Context; use C4::Context;
use C4::Output qw( output_with_http_headers is_ajax pagination_bar output_html_with_http_headers ); use C4::Output qw( output_with_http_headers is_ajax pagination_bar output_html_with_http_headers );
use C4::Tags qw( use C4::Tags qw(
@ -46,6 +45,8 @@ sub ajax_auth_cgi { # returns CGI object
my $sessid = $cookies{'CGISESSID'}->value; my $sessid = $cookies{'CGISESSID'}->value;
my ($auth_status) = check_cookie_auth( $sessid, $needed_flags ); my ($auth_status) = check_cookie_auth( $sessid, $needed_flags );
if ( $auth_status ne "ok" ) { if ( $auth_status ne "ok" ) {
#FIMXE: This should return a HTTP error and not a script
output_with_http_headers $input, undef, output_with_http_headers $input, undef,
"window.alert('Your CGI session cookie ($sessid) is not current. " "window.alert('Your CGI session cookie ($sessid) is not current. "
. "Please refresh the page and try again.');\n", 'js'; . "Please refresh the page and try again.');\n", 'js';
@ -73,7 +74,7 @@ if ( is_ajax() ) {
status => $status, status => $status,
tag => $tag, tag => $tag,
}; };
output_with_http_headers $input, undef, encode_json($response), 'js'; output_with_http_headers $input, undef, encode_json($response), 'json';
exit; exit;
} }