Bug 19108: Fix Stored XSS in biblio_framework.pl and marctagstructure.pl
[koha.git] / koha-tmpl / intranet-tmpl / prog / en / modules / admin / biblio_framework.tt
index 97fd640..166663f 100644 (file)
@@ -3,96 +3,26 @@
 [% IF op == 'add_form' %]
 › [% IF framework %]Modify framework text[% ELSE %]Add framework[% END %]
 [% ELSIF op == 'delete_confirm' %]
-› Delete framework for [% framework.frameworktext %] ([% framework.frameworkcode %])?
+› Delete framework for [% framework.frameworktext |html %] ([% framework.frameworkcode %])?
 [% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
-<link rel="stylesheet" type="text/css" href="[% themelang %]/css/datatables.css" />
+<link rel="stylesheet" type="text/css" href="[% interface %]/[% theme %]/css/datatables.css" />
 [% INCLUDE 'datatables.inc' %]
 <script type="text/javascript">
-/* Import/Export from/to spreadsheet */
-
-    var importing = false;
-
-    $(document).ready(function() {
-        $("#table_biblio_frameworks").dataTable($.extend(true, {}, dataTablesDefaults, {
-            "aoColumnDefs": [
-                { "aTargets": [ -1 ], "bSortable": false, "bSearchable": false },
-                { "aTargets": [ 0, 1 ], "sType": "natural" },
-            ],
-            "bSort": true,
-            "sPaginationType": "four_button"
-        }));
-
-        $("body").css("cursor", "auto");
-        $('.import_export_options').hide();
-        $('a.import_export_fw').click(function() {
-            if (!importing) {
-                $('.import_export_options').hide();
-                $(this).next().show('slide');
-            }
-            return false;
-        });
-        $('.import_export_close').click(function() {
-            if (!importing) {
-                $('.import_export_options').fadeOut('fast');
-                $("body").css("cursor", "auto");
-                return false;
-            }
-        });
-        $('.input_import').val("");
-
-        var matches = new RegExp("\\?error_import_export=(.+)$").exec(window.location.search);
-        if (matches && matches.length > 1) {
-            alert(_("Error importing the framework %s").format(decodeURIComponent(matches[1])));
-        }
-
-        $('input.input_import').change( function() {
-            var filename = $(this).val();
-            if ( ! /(?:\.csv|\.ods|\.xml)$/.test(filename)) {
-                $(this).css("background-color","yellow");
-                alert(_("Please select a CSV (.csv), ODS (.ods) or XML (.xml) spreadsheet file."));
-                $(this).val("");
-                $(this).css("background-color","white");
-            }
-        });
-        $('form.form_export').submit(function() {
-            $('.modal').modal("hide");
-            return true;
-        });
-        $('form.form_import').submit(function() {
-            var id = $(this).attr('id');
-            var obj = $('#' + id + ' input:file');
-            if (/(?:\.csv|\.ods|\.xml)$/.test(obj.val())) {
-                if (confirm(_("Do you really want to import the framework fields and subfields? This will overwrite the current configuration. For safety reasons please use the export option to make a backup"))) {
-                    var frameworkcode = $('#' + id + ' input:hidden[name=frameworkcode]').val();
-                    $('#importing_' + frameworkcode).find("span").html(_("Importing to framework: %s. Importing from file: %s").format("<strong>" + frameworkcode + "</strong>", "<i>" + obj.val().replace(new RegExp("^.+[/\\\\]"),"") + "</i>"));
-                    if (navigator.userAgent.toLowerCase().indexOf('msie') != -1) {
-                        var timestamp = new Date().getTime();
-                        $('#importing_' + frameworkcode).find("img").attr('src', '[% interface %]/[% theme %]/img/loading-small.gif' + '?' +timestamp);
-                    }
-                    $('#importing_' + frameworkcode).css('display', 'block');
-                    if (navigator.userAgent.toLowerCase().indexOf('firefox') == -1) $("body").css("cursor", "progress");
-                    importing = true;
-                    $(".modal-footer,.closebtn").hide();
-                    return true;
-                } else
-                    return false;
-            }
-            obj.css("background-color","yellow");
-            alert(_("Please select a CSV (.csv), ODS (.ods) or XML (.xml) spreadsheet file."));
-            obj.val("");
-            obj.css("background-color","white");
-            return false;
-        });
-    });
-
+    /* Set some variable needed in biblio_framework.js */
+    var MSG_IMPORT_ERROR = _("Error importing the framework");
+    var MSG_SELECT_FILE_FORMAT = _("Please select a CSV (.csv), ODS (.ods) or XML (.xml) spreadsheet file.");
+    var MSG_OVERWRITE_WARNING = _("Do you really want to import the framework fields and subfields? This will overwrite the current configuration. For safety reasons please use the export option to make a backup");
+    var MSG_IMPORTING_TO_FRAMEWORK = _("Importing to framework: %s. Importing from file: %s.");
+    var template_path = "[% interface %]/[% theme %]";
 </script>
+<script type="text/javascript" src="[% interface %]/[% theme %]/js/biblio_framework.js"></script>
 
 </head>
 <body id="admin_biblio_framework" class="admin">
 [% INCLUDE 'header.inc' %]
-[% INCLUDE 'cat-search.inc' %]
+[% INCLUDE 'prefs-admin-search.inc' %]
 
 <div id="breadcrumbs">
         <a href="/cgi-bin/koha/mainpage.pl">Home</a>
 [% IF op == 'add_form' %]
 &rsaquo; [% IF framework %]Modify framework text[% ELSE %]Add framework[% END %]
 [% ELSIF op == 'delete_confirm' %]
-&rsaquo; Delete framework for [% framework.frameworktext %] ([% framework.frameworkcode %])?
+&rsaquo; Delete framework for [% framework.frameworktext |html %] ([% framework.frameworkcode %])?
 [% END %]
 </div>
 
 
 [% IF op == 'list'%]
     <div id="toolbar" class="btn-toolbar">
-        <a class="btn btn-small" id="newframework" href="/cgi-bin/koha/admin/biblio_framework.pl?op=add_form"><i class="fa fa-plus"></i> New framework</a>
+        <a class="btn btn-default btn-sm" id="newframework" href="/cgi-bin/koha/admin/biblio_framework.pl?op=add_form"><i class="fa fa-plus"></i> New framework</a>
     </div>
 [% END %]
 
                 [% ELSE %]
                     <li>
                         <label for="frameworkcode" class="required">Framework code: </label>
-                        <input type="text" id="frameworkcode" name="frameworkcode" size="4" maxlength="4" onblur="toUC(this)" required="required" class="required" />
+                        <input type="text" id="frameworkcode" name="frameworkcode" size="4" maxlength="4" required="required" class="required" />
                         <span class="required">Required</span>
                     </li>
                 [% END %]
     <div class="dialog alert">
         [% IF biblios_use_this_framework %]
             <h3>This framework cannot be deleted</h3>
-            <p><strong><span class="ex">[% framework.frameworktext %] ([% framework.frameworkcode %])</span></strong></p>
+            <p><strong><span class="ex">[% framework.frameworktext |text %] ([% framework.frameworkcode %])</span></strong></p>
             <p>The framework is used [% biblios_use_this_framework %] times.</p>
             <form action="/cgi-bin/koha/admin/biblio_framework.pl" method="get">
                 <button type="submit"><i class="fa fa-fw fa-arrow-left"></i> Return to frameworks</button>
             </form>
         [% ELSE %]
-            <h3>Delete framework for [% framework.frameworktext %] ([% framework.frameworkcode %])?</h3>
+            <h3>Delete framework for [% framework.frameworktext |html %] ([% framework.frameworkcode %])?</h3>
             <form class="inline" action="/cgi-bin/koha/admin/biblio_framework.pl" method="post">
                 <input type="hidden" name="op" value="delete_confirmed" />
                 <input type="hidden" name="frameworkcode" value="[% framework.frameworkcode %]" />
         <td>Default framework</td>
         <td>
           <div class="dropdown">
-            <a class="btn btn-mini dropdown-toggle" id="frameworkactions[% loo.frameworkcode %]" role="button" data-toggle="dropdown" href="#">
+            <a class="btn btn-default btn-xs dropdown-toggle" id="frameworkactions[% loo.frameworkcode %]" role="button" data-toggle="dropdown" href="#">
               Actions <b class="caret"></b>
             </a>
             <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="frameworkactions[% loo.frameworkcode %]">
               <li><a href="#" data-toggle="modal" data-target="#importModal_[% framework.frameworkcode %][% frameworks.count %]" title="Import framework structure (fields, subfields) from a spreadsheet file (.csv, .xml, .ods)"><i class="fa fa-download"></i> Import</a></li>
             </ul>
             <!-- Modal to export default framework -->
-            <div class="modal hide" id="exportModal_default" tabindex="-1" role="dialog" aria-labelledby="exportLabelexportModal_default" aria-hidden="true">
+            <div class="modal" id="exportModal_default" tabindex="-1" role="dialog" aria-labelledby="exportLabelexportModal_default" aria-hidden="true">
+              <div class="modal-dialog">
+              <div class="modal-content">
               <div class="modal-header">
                 <button type="button" class="closebtn" data-dismiss="modal" aria-hidden="true">×</button>
                 <h3 id="exportLabelexportModal_default">Export default framework</h3>
                   </fieldset>
                 </div>
                 <div class="modal-footer">
-                  <button type="submit" class="btn">Export</button>
+                  <button type="submit" class="btn btn-default">Export</button>
                   <button class="btn btn-link" data-dismiss="modal" aria-hidden="true">Cancel</button>
                 </div>
               </form>
+              </div>
+              </div>
             </div>
 
             <!-- Modal to import default framework -->
-            <div class="modal hide" id="importModal_[% framework.frameworkcode %][% frameworks.count %]" tabindex="-1" role="dialog" aria-labelledby="importLabelexportModal_default[% frameworks.count %]" aria-hidden="true">
+            <div class="modal" id="importModal_[% framework.frameworkcode %][% frameworks.count %]" tabindex="-1" role="dialog" aria-labelledby="importLabelexportModal_default[% frameworks.count %]" aria-hidden="true">
+              <div class="modal-dialog">
+              <div class="modal-content">
               <div class="modal-header">
                 <button type="button" class="closebtn" data-dismiss="modal" aria-hidden="true">×</button>
                 <h3 id="importLabelexportModal_[% framework.frameworkcode %][% frameworks.count %]">Import default framework structure (fields and subfields) from a spreadsheet file (.csv, .xml, .ods)</h>
                   <input type="hidden" name="frameworkcode" value="default" />
                   <input type="hidden" name="action" value="import" />
                   <p><label for="file_import_default">Upload file:</label> <input type="file" name="file_import_default" id="file_import_default" class="input_import" /></p>
-                    <div id="importing_default" style="display:none" class="importing"><img src="[% interface %]/[% theme %]/img/loading-small.gif" alt="" /><span class="importing_msg"></span></div>
+                    <div id="importing_default" style="display:none" class="importing"><img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /><span class="importing_msg"></span></div>
                 </div>
                 <div class="modal-footer">
-                  <button type="submit" class="btn">Import</button>
+                  <button type="submit" class="btn btn-default">Import</button>
                   <button class="btn btn-link" data-dismiss="modal" aria-hidden="true">Close</button>
                 </div>
               </form>
+              </div>
+              </div>
             </div>
           </div>
         </td>
     [% FOREACH loo IN frameworks %]
         <tr>
             <td>[% loo.frameworkcode %]</td>
-            <td>[% loo.frameworktext %]</td>
+            <td>[% loo.frameworktext |html %]</td>
             <td>
               <div class="dropdown">
-                <a class="btn btn-mini dropdown-toggle" id="frameworkactions[% loo.frameworkcode %]" role="button" data-toggle="dropdown" href="#">
+                <a class="btn btn-default btn-xs dropdown-toggle" id="frameworkactions[% loo.frameworkcode %]" role="button" data-toggle="dropdown" href="#">
                   Actions <b class="caret"></b>
                 </a>
                 <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="frameworkactions[% loo.frameworkcode %]">
                   <li><a href="#" data-toggle="modal" data-target="#importModal_[% loo.frameworkcode %][% loop.count %]" title="Import framework structure (fields, subfields) from a spreadsheet file (.csv, .xml, .ods)"><i class="fa fa-download"></i> Import</a></li>
                 </ul>
                 <!-- Modal to export other framework -->
-                <div class="modal hide" id="exportModal_[% loo.frameworkcode %][% loop.count %]" tabindex="-1" role="dialog" aria-labelledby="exportLabelexportModal_[% loo.frameworkcode %][% loop.count %]" aria-hidden="true">
+                <div class="modal" id="exportModal_[% loo.frameworkcode %][% loop.count %]" tabindex="-1" role="dialog" aria-labelledby="exportLabelexportModal_[% loo.frameworkcode %][% loop.count %]" aria-hidden="true">
+                  <div class="modal-dialog">
+                  <div class="modal-content">
                   <div class="modal-header">
                     <button type="button" class="closebtn" data-dismiss="modal" aria-hidden="true">×</button>
-                    <h3 id="exportLabelexportModal_[% loo.frameworkcode %][% loop.count %]">Export [% loo.frameworktext %] framework</h3>
+                    <h3 id="exportLabelexportModal_[% loo.frameworkcode %][% loop.count %]">Export [% loo.frameworktext |html %] framework</h3>
                   </div>
                   <form action="import_export_framework.pl" name="form_[% loo.frameworkcode %]" method="get" target="_blank"  class="form_export">
                     <div class="modal-body">
                       </fieldset>
                     </div>
                     <div class="modal-footer">
-                      <button type="submit" class="btn">Export</button>
+                      <button type="submit" class="btn btn-default">Export</button>
                       <button class="btn btn-link" data-dismiss="modal" aria-hidden="true">Cancel</button>
                     </div>
                   </form>
+                  </div>
+                  </div>
                 </div>
 
                 <!-- Modal to import other framework -->
-                <div class="modal hide" id="importModal_[% loo.frameworkcode %][% loop.count %]" tabindex="-1" role="dialog" aria-labelledby="importLabelexportModal_[% loo.frameworkcode %][% loop.count %]" aria-hidden="true">
+                <div class="modal" id="importModal_[% loo.frameworkcode %][% loop.count %]" tabindex="-1" role="dialog" aria-labelledby="importLabelexportModal_[% loo.frameworkcode %][% loop.count %]" aria-hidden="true">
+                  <div class="modal-dialog">
+                  <div class="modal-content">
                   <div class="modal-header">
                     <button type="button" class="closebtn" data-dismiss="modal" aria-hidden="true">×</button>
                     <h3 id="importLabelexportModal_[% loo.frameworkcode %][% loop.count %]">Import [% loo.frameworkcode %] framework structure (fields and subfields) from a spreadsheet file (.csv, .xml, .ods)</h3>
                       <input type="hidden" name="frameworkcode" value="[% loo.frameworkcode %]" />
                       <input type="hidden" name="action" value="import" />
                       <p><label for="file_import_[% loo.frameworkcode %]">Upload file:</label> <input type="file" name="file_import_[% loo.frameworkcode %]" id="file_import_[% loo.frameworkcode %]" class="input_import" /></p>
-                      <div id="importing_[% loo.frameworkcode %]" style="display:none" class="importing"><img src="[% interface %]/[% theme %]/img/loading-small.gif" alt="" /><span class="importing_msg"></span></div>
+                      <div id="importing_[% loo.frameworkcode %]" style="display:none" class="importing"><img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /><span class="importing_msg"></span></div>
                     </div>
                     <div class="modal-footer">
-                      <button type="submit" class="btn">Import</button>
+                      <button type="submit" class="btn btn-default">Import</button>
                       <button class="btn btn-link" data-dismiss="modal" aria-hidden="true">Close</button>
                     </div>
                   </form>
+                  </div>
+                  </div>
                 </div>
               </div>
             </td>