gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 20891: Escape html then JSON 

To my understanding we need to escape first html chars then to JSON.

If this patch works we will need to rethink the 'To' TT plugin.
It was originally designed to have several escape methods, but with
these changes it will not make sense to name it 'To' if used only to
escape JSON

IIRC we should keep the 2 different ways to use it:
 * [% To.json( string ) %]
 * [% string | $To %]
otherwise it will be hard to use it when called in argument of
patron-title.inc (`git grep To.json`)

Signed-off-by: Liz Rea <wizzyrea@gmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit bdf0d85c1d)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 6bf436065e)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Jonathan Druart 2018-06-08 12:19:41 -03:00 committed by Lucas Gass
parent a53d1a733c
commit 713784ff0b
2 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
Koha/Template/Plugin/To.pm
View File

@ -19,9 +19,11 @@ package Koha::Template::Plugin::To;
use Modern::Perl;
use base qw( Template::Plugin );
use Template::Plugin::Filter;
use base qw( Template::Plugin::Filter );
use JSON qw( to_json );
our $DYNAMIC = 1;
sub json {
my ( $self, $value ) = @_;
@ -34,4 +36,9 @@ sub json {
return $json;
}
sub filter {
my ( $self, $value ) = @_;
return $self->json($value);
}
1;

4
koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt
View File

@ -10,13 +10,13 @@
"dt_type":
"[% data.type %]",
"dt_shelfname":
"<a href='/cgi-bin/koha/virtualshelves/shelves.pl?op=view&shelfnumber=[% data.shelfnumber | html %]'>[% To.json(data.shelfname) | html%]</a>",
"<a href='/cgi-bin/koha/virtualshelves/shelves.pl?op=view&shelfnumber=[% data.shelfnumber | html %]'>[% data.shelfname | html | $To %]</a>",
"dt_count":
"[% data.count %] item(s)",
"dt_is_shared":
"[% IF data.type == 2 %]Public[% ELSIF data.is_shared %]Shared[% ELSE %]Private[% END %]",
"dt_owner":
"<a href='/cgi-bin/koha/members/moremember.pl?borrowernumber=[% data.owner | html %]'>[% To.json(data.firstname) | html %] [% To.json(data.surname) | html %]</a>",
"<a href='/cgi-bin/koha/members/moremember.pl?borrowernumber=[% data.owner | html %]'>[% data.firstname | html | $To %] [% data.surname | html | $To %]</a>",
"dt_sortby":
[% IF data.sortby == "author" %]"Author"[% ELSIF data.sortby == "copyrightdate" %]"Year"[% ELSIF data.sortby == "itemcallnumber" %]"Call number"[% ELSE %]"Title"[% END %],
"dt_created_on":