gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42254: (follow-up) tweaks to improve XSS fix 

This change removes useless success_* calls, removes an unnecessary
'use URI::Escape qw( uri_unescape );' in the Perl, adds a missing
response function argument, uses a safe sink for the "verdict" element
to make the content setting a bit cleaner.

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
David Cook 2026-04-07 03:07:42 +00:00 committed by Lucas Gass
parent 822cd31930
commit 517edc11a8
No known key found for this signature in database
GPG Key ID: 60B447398B0D36CA
2 changed files with 28 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js
View File

@ -20,9 +20,9 @@ function pull_counts() {
);
}
function count_approve() {
function count_approve(response) {
if (response.status == "success") {
success_approve(response.tag);
//success_approve(response.tag);
} else {
failure_approve(response.tag);
}
@ -35,7 +35,7 @@ function count_approve() {
function count_reject(response) {
if (response.status == "success") {
success_reject(response.tag);
//success_reject(response.tag);
} else {
failure_reject(response.tag);
}
@ -46,28 +46,37 @@ function count_reject(response) {
}
}
var success_approve = function (tag) {
// window.alert(__("AJAX approved tag: ") + tag);
};
//var success_approve = function (tag) {
// window.alert(__("AJAX approved tag: ") + tag);
//};
var failure_approve = function (tag) {
window.alert(__("AJAX failed to approve tag: %s").format(escape_str(tag)));
};
var success_reject = function (tag) {
// window.alert(__("AJAX rejected tag: ") + tag);
};
//var success_reject = function (tag) {
// window.alert(__("AJAX rejected tag: ") + tag);
//};
var failure_reject = function (tag) {
window.alert(__("AJAX failed to reject tag: %s").format(escape_str(tag)));
};
var success_test = function (tag) {
$("#verdict").html(__("%s is permitted!").format(escape_str(tag)));
const verdict = document.querySelector("#verdict");
if (verdict) {
verdict.textContent = __("%s is permitted!").format(tag);
}
};
var failure_test = function (tag) {
$("#verdict").html(__("%s is prohibited!").format(escape_str(tag)));
const verdict = document.querySelector("#verdict");
if (verdict) {
verdict.textContent = __("%s is prohibited!").format(tag);
}
};
var indeterminate_test = function (tag) {
$("#verdict").html(
__("%s is neither permitted nor prohibited!").format(escape_str(tag))
);
const verdict = document.querySelector("#verdict");
if (verdict) {
verdict.textContent = __(
"%s is neither permitted nor prohibited!"
).format(tag);
}
};
var success_test_call = function (response) {

5
tags/review.pl
View File

@ -23,7 +23,6 @@ use Modern::Perl;
use POSIX qw( ceil );
use CGI qw ( -utf8 );
use CGI::Cookie; # need to check cookies before having CGI parse the POST request
use URI::Escape qw( uri_unescape );
use JSON qw(encode_json);
use C4::Auth qw( check_cookie_auth get_template_and_user );
use C4::Context;
@ -46,6 +45,8 @@ sub ajax_auth_cgi { # returns CGI object
my $sessid = $cookies{'CGISESSID'}->value;
my ($auth_status) = check_cookie_auth( $sessid, $needed_flags );
if ( $auth_status ne "ok" ) {
#FIMXE: This should return a HTTP error and not a script
output_with_http_headers $input, undef,
"window.alert('Your CGI session cookie ($sessid) is not current. "
. "Please refresh the page and try again.');\n", 'js';
@ -73,7 +74,7 @@ if ( is_ajax() ) {
status => $status,
tag => $tag,
};
output_with_http_headers $input, undef, encode_json($response), 'js';
output_with_http_headers $input, undef, encode_json($response), 'json';
exit;
}