gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42224: (Bug 40524 follow-up) [24.11.x] Fix XSS in columns_settings.inc 

Bug 40524 fixed XSS issue in koha-tmpl/intranet-tmpl/prog/js/datatables.js

But in 24.11 and lower, DataTable are also build with koha-tmpl/intranet-tmpl/prog/en/includes/columns_settings.inc
So same fix needs to applied.

Also in 24.11.x and lower the columns use "noExport" instead of "no-export"

Test plan:
Use the one from Bug 40524

Signed-off-by: David Cook <dcook@prosentient.com.au>
This commit is contained in:
Fridolin Somers 2026-03-31 12:04:58 +02:00 committed by Baptiste Wojtkowski
parent 0aafc9a60a
commit 61056b323e
No known key found for this signature in database
GPG Key ID: 47A8A13E10BC0D40
2 changed files with 23 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
koha-tmpl/intranet-tmpl/prog/en/includes/columns_settings.inc
View File

@ -89,6 +89,26 @@ function KohaTable(id_selector, dt_parameters, table_settings, add_filters, defa
}
}
const export_format_print = {
body: function (data, row, column, node) {
const newnode = node.cloneNode(true);
const no_export_nodes = newnode.querySelectorAll(".noExport");
no_export_nodes.forEach(child => {
child.parentNode.removeChild(child);
});
//Note: innerHTML is the same thing as the data variable,
//minus the ".noExport" nodes that we've removed
//Note: See dataTables.buttons.js for original function usage
const str = DataTable.Buttons.stripData(newnode.innerHTML, {
decodeEntities: false,
stripHtml: true,
stripNewlines: true,
trim: true,
});
return str;
},
};
var export_format = {
body: function ( data, row, column, node ) {
var newnode = $(node);
@ -141,7 +161,7 @@ function KohaTable(id_selector, dt_parameters, table_settings, add_filters, defa
exportOptions: {
columns: exportColumns,
rows: exportRows,
format: export_format
format: export_format_print
},
}
];

4
koha-tmpl/intranet-tmpl/prog/js/datatables.js
View File

@ -705,12 +705,12 @@ function _dt_buttons(params){
const export_format_print = {
body: function (data, row, column, node) {
const newnode = node.cloneNode(true);
const no_export_nodes = newnode.querySelectorAll(".no-export");
const no_export_nodes = newnode.querySelectorAll(".noExport");
no_export_nodes.forEach(child => {
child.parentNode.removeChild(child);
});
//Note: innerHTML is the same thing as the data variable,
//minus the ".no-export" nodes that we've removed
//minus the ".noExport" nodes that we've removed
//Note: See dataTables.buttons.js for original function usage
const str = DataTable.Buttons.stripData(newnode.innerHTML, {
decodeEntities: false,