gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 15814: Handle correctly MMTA edit button 

The MARC modification template action edit buton does not correctly
handle variable escaping.
Assigning a JS variable containing the JSON representation of the
hashref will make the processing much more easier.

Test plan:
Create a MARC Modification Template with several actions.
In the description you should use the following characters, to try to
break this patch: \ ' " \n \r
(not sure what we handled \n and \r)
Then edit the action, modify and save again.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 7a80483a13)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 68424ae5ad)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Jonathan Druart 2019-05-29 21:28:23 -05:00 committed by Lucas Gass
parent cb5767b79d
commit e73a82c830
2 changed files with 32 additions and 45 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
koha-tmpl/intranet-tmpl/prog/en/modules/tools/marc_modification_templates.tt
View File

@ -1,4 +1,5 @@
[% USE raw %]
[% USE JSON.Escape %]
[% USE Asset %]
[% SET footerjs = 1 %]
[% INCLUDE 'doc-head-open.inc' %]
@ -162,27 +163,7 @@
</td>
<td>[% ActionsLoo.description | html %]</td>
<td>
<a class="btn btn-default btn-xs" href="#modaction" onclick='editAction(
"[% ActionsLoo.mmta_id |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
"[% ActionsLoo.ordering |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
"[% ActionsLoo.action |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
"[% ActionsLoo.field_number |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
"[% ActionsLoo.from_field |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
"[% ActionsLoo.from_subfield |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
"[% ActionsLoo.field_value |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
"[% ActionsLoo.to_field |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
"[% ActionsLoo.to_subfield |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
"[% ActionsLoo.to_regex_search |replace('\\\\', '\\\\') |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
"[% ActionsLoo.to_regex_replace |replace('\\\\', '\\\\') |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
"[% ActionsLoo.to_regex_modifiers |replace('\\\\', '\\\\') |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
"[% ActionsLoo.conditional |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
"[% ActionsLoo.conditional_field |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
"[% ActionsLoo.conditional_subfield |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
"[% ActionsLoo.conditional_comparison |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
"[% ActionsLoo.conditional_value |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
"[% ActionsLoo.conditional_regex |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
"[% ActionsLoo.description |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"
);updateAllEvery();'><i class="fa fa-pencil"></i> Edit</a>
<a class="btn btn-default btn-xs edit_action" href="#modaction" data-mmta_id="[% ActionsLoo.mmta_id %]"><i class="fa fa-pencil"></i> Edit</a>
</td>
<td>
<a class="btn btn-default btn-xs" href="marc_modification_templates.pl?template_id=[% ActionsLoo.template_id | html %]&op=delete_action&mmta_id=[% ActionsLoo.mmta_id | html %]" onclick="return confirmDeleteAction();"><i class="fa fa-trash"></i> Delete</a>
@ -358,6 +339,7 @@
var MSG_MMT_CONDITIONAL_COMPARISON_REQUIRED = _("The conditional comparison operator should be filled.");
var MSG_MMT_CONDITIONAL_VALUE_REQUIRED = _("The conditional value should be filled.");
var MSG_MMT_CONDITIONAL_VALUE_REGEX_REQUIRED = _("The conditional regular expression should be filled.");
var mmtas = [% ActionsLoop.json %]
</script>
[% Asset.js("js/marc_modification_templates.js") | $raw %]
[% END %]

53
koha-tmpl/intranet-tmpl/prog/js/marc_modification_templates.js
View File

@ -99,6 +99,14 @@ $(document).ready(function() {
return confirmDelete();
});
$(".edit_action").on("click", function(){
var mmta_id = $(this).data("mmta_id");
var mmta = $.grep(mmtas, function(elt, id) {
return elt['mmta_id'] == mmta_id;
});
editAction( mmta[0] );
updateAllEvery();
});
});
function updateAllEvery(){
@ -258,50 +266,47 @@ function confirmDelete() {
var modaction_legend_innerhtml;
var action_submit_value;
function editAction( mmta_id, ordering, action, field_number, from_field, from_subfield, field_value, to_field,
to_subfield, to_regex_search, to_regex_replace, to_regex_modifiers, conditional, conditional_field, conditional_subfield,
conditional_comparison, conditional_value, conditional_regex, description
) {
function editAction( mmta ) {
$("#add_action").show();
document.getElementById('mmta_id').value = mmta_id;
document.getElementById('mmta_id').value = mmta['mmta_id'];
setSelectByValue( 'action', action );
setSelectByValue( 'action', mmta['action'] );
$('#action').change();
setSelectByValue( 'field_number', field_number );
setSelectByValue( 'field_number', mmta['field_number'] );
document.getElementById('from_field').value = from_field;
document.getElementById('from_subfield').value = from_subfield;
document.getElementById('field_value').value = field_value;
document.getElementById('to_field').value = to_field;
document.getElementById('to_subfield').value = to_subfield;
if ( to_regex_search == '' && to_regex_replace == '' && to_regex_modifiers == '' ) {
document.getElementById('from_field').value = mmta['from_field'];
document.getElementById('from_subfield').value = mmta['from_subfield'];
document.getElementById('field_value').value = mmta['field_value'];
document.getElementById('to_field').value = mmta['to_field'];
document.getElementById('to_subfield').value = mmta['to_subfield'];
if ( mmta['regex_search'] == '' && mmta['to_regex_replace'] == '' && mmta['to_regex_modifiers'] == '' ) {
$('#to_field_regex').prop('checked', false).change();
} else {
$('#to_field_regex').prop('checked', true).change();
$("#to_regex_search").val(to_regex_search);
$("#to_regex_replace").val(to_regex_replace);
$("#to_regex_modifiers").val(to_regex_modifiers);
$("#to_regex_search").val(mmta['to_regex_search']);
$("#to_regex_replace").val(mmta['to_regex_replace']);
$("#to_regex_modifiers").val(mmta['to_regex_modifiers']);
}
setSelectByValue( 'conditional', conditional );
setSelectByValue( 'conditional', mmta['conditional'] );
$('#conditional').change();
document.getElementById('conditional_field').value = conditional_field;
document.getElementById('conditional_subfield').value = conditional_subfield;
document.getElementById('conditional_field').value = mmta['conditional_field'];
document.getElementById('conditional_subfield').value = mmta['conditional_subfield'];
setSelectByValue( 'conditional_comparison', conditional_comparison );
setSelectByValue( 'conditional_comparison', mmta['conditional_comparison'] );
$('#conditional_comparison').change();
document.getElementById('conditional_value').value = conditional_value;
document.getElementById('conditional_value').value = mmta['conditional_value'];
document.getElementById('conditional_regex').checked = parseInt( conditional_regex );
document.getElementById('conditional_regex').checked = parseInt( mmta['conditional_regex'] );
$('#conditional_regex').change();
document.getElementById('description').value = description;
document.getElementById('description').value = mmta['description'];
window.modaction_legend_innerhtml = document.getElementById('modaction_legend').innerHTML;
document.getElementById('modaction_legend').innerHTML = MSG_MMT_EDIT_ACTION.format(ordering);
document.getElementById('modaction_legend').innerHTML = MSG_MMT_EDIT_ACTION.format(mmta['ordering']);
window.action_submit_value = document.getElementById('action_submit').value;
document.getElementById('action_submit').value = MSG_MMT_UPDATE_ACTION;