Bug 19108: Fix Stored XSS in biblio_framework.pl and marctagstructure.pl

[koha.git] / koha-tmpl / intranet-tmpl / prog / en / modules / admin / biblio_framework.tt
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt

index ebf449c..166663f 100644 (file)
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt
@@ -3,7 +3,7 @@
  [% IF op == 'add_form' %]
  &rsaquo; [% IF framework %]Modify framework text[% ELSE %]Add framework[% END %]
  [% ELSIF op == 'delete_confirm' %]
-&rsaquo; Delete framework for [% framework.frameworktext %] ([% framework.frameworkcode %])?
+&rsaquo; Delete framework for [% framework.frameworktext |html %] ([% framework.frameworkcode %])?
  [% END %]
  </title>
  [% INCLUDE 'doc-head-close.inc' %]
@@ -22,7 +22,7 @@
  </head>
  <body id="admin_biblio_framework" class="admin">
  [% INCLUDE 'header.inc' %]
-[% INCLUDE 'cat-search.inc' %]
+[% INCLUDE 'prefs-admin-search.inc' %]
  
  <div id="breadcrumbs">
          <a href="/cgi-bin/koha/mainpage.pl">Home</a>
@@ -31,7 +31,7 @@
  [% IF op == 'add_form' %]
  &rsaquo; [% IF framework %]Modify framework text[% ELSE %]Add framework[% END %]
  [% ELSIF op == 'delete_confirm' %]
-&rsaquo; Delete framework for [% framework.frameworktext %] ([% framework.frameworkcode %])?
+&rsaquo; Delete framework for [% framework.frameworktext |html %] ([% framework.frameworkcode %])?
  [% END %]
  </div>
  
@@ -67,7 +67,7 @@
  
  [% IF op == 'list'%]
      <div id="toolbar" class="btn-toolbar">
-        <a class="btn btn-small" id="newframework" href="/cgi-bin/koha/admin/biblio_framework.pl?op=add_form"><i class="fa fa-plus"></i> New framework</a>
+        <a class="btn btn-default btn-sm" id="newframework" href="/cgi-bin/koha/admin/biblio_framework.pl?op=add_form"><i class="fa fa-plus"></i> New framework</a>
      </div>
  [% END %]
  
@@ -86,7 +86,7 @@
                  [% ELSE %]
                      <li>
                          <label for="frameworkcode" class="required">Framework code: </label>
-                        <input type="text" id="frameworkcode" name="frameworkcode" size="4" maxlength="4" onblur="toUC(this)" required="required" class="required" />
+                        <input type="text" id="frameworkcode" name="frameworkcode" size="4" maxlength="4" required="required" class="required" />
                          <span class="required">Required</span>
                      </li>
                  [% END %]
@@ -107,13 +107,13 @@
      <div class="dialog alert">
          [% IF biblios_use_this_framework %]
              <h3>This framework cannot be deleted</h3>
-            <p><strong><span class="ex">[% framework.frameworktext %] ([% framework.frameworkcode %])</span></strong></p>
+            <p><strong><span class="ex">[% framework.frameworktext |text %] ([% framework.frameworkcode %])</span></strong></p>
              <p>The framework is used [% biblios_use_this_framework %] times.</p>
              <form action="/cgi-bin/koha/admin/biblio_framework.pl" method="get">
                  <button type="submit"><i class="fa fa-fw fa-arrow-left"></i> Return to frameworks</button>
              </form>
          [% ELSE %]
-            <h3>Delete framework for [% framework.frameworktext %] ([% framework.frameworkcode %])?</h3>
+            <h3>Delete framework for [% framework.frameworktext |html %] ([% framework.frameworkcode %])?</h3>
              <form class="inline" action="/cgi-bin/koha/admin/biblio_framework.pl" method="post">
                  <input type="hidden" name="op" value="delete_confirmed" />
                  <input type="hidden" name="frameworkcode" value="[% framework.frameworkcode %]" />
@@ -143,7 +143,7 @@
          <td>Default framework</td>
          <td>
            <div class="dropdown">
-            <a class="btn btn-mini dropdown-toggle" id="frameworkactions[% loo.frameworkcode %]" role="button" data-toggle="dropdown" href="#">
+            <a class="btn btn-default btn-xs dropdown-toggle" id="frameworkactions[% loo.frameworkcode %]" role="button" data-toggle="dropdown" href="#">
                Actions <b class="caret"></b>
              </a>
              <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="frameworkactions[% loo.frameworkcode %]">
@@ -154,7 +154,9 @@
                <li><a href="#" data-toggle="modal" data-target="#importModal_[% framework.frameworkcode %][% frameworks.count %]" title="Import framework structure (fields, subfields) from a spreadsheet file (.csv, .xml, .ods)"><i class="fa fa-download"></i> Import</a></li>
              </ul>
              <!-- Modal to export default framework -->
-            <div class="modal hide" id="exportModal_default" tabindex="-1" role="dialog" aria-labelledby="exportLabelexportModal_default" aria-hidden="true">
+            <div class="modal" id="exportModal_default" tabindex="-1" role="dialog" aria-labelledby="exportLabelexportModal_default" aria-hidden="true">
+              <div class="modal-dialog">
+              <div class="modal-content">
                <div class="modal-header">
                  <button type="button" class="closebtn" data-dismiss="modal" aria-hidden="true">×</button>
                  <h3 id="exportLabelexportModal_default">Export default framework</h3>
@@ -169,14 +171,18 @@
                    </fieldset>
                  </div>
                  <div class="modal-footer">
-                  <button type="submit" class="btn">Export</button>
+                  <button type="submit" class="btn btn-default">Export</button>
                    <button class="btn btn-link" data-dismiss="modal" aria-hidden="true">Cancel</button>
                  </div>
                </form>
+              </div>
+              </div>
              </div>
  
              <!-- Modal to import default framework -->
-            <div class="modal hide" id="importModal_[% framework.frameworkcode %][% frameworks.count %]" tabindex="-1" role="dialog" aria-labelledby="importLabelexportModal_default[% frameworks.count %]" aria-hidden="true">
+            <div class="modal" id="importModal_[% framework.frameworkcode %][% frameworks.count %]" tabindex="-1" role="dialog" aria-labelledby="importLabelexportModal_default[% frameworks.count %]" aria-hidden="true">
+              <div class="modal-dialog">
+              <div class="modal-content">
                <div class="modal-header">
                  <button type="button" class="closebtn" data-dismiss="modal" aria-hidden="true">×</button>
                  <h3 id="importLabelexportModal_[% framework.frameworkcode %][% frameworks.count %]">Import default framework structure (fields and subfields) from a spreadsheet file (.csv, .xml, .ods)</h>
@@ -186,13 +192,15 @@
                    <input type="hidden" name="frameworkcode" value="default" />
                    <input type="hidden" name="action" value="import" />
                    <p><label for="file_import_default">Upload file:</label> <input type="file" name="file_import_default" id="file_import_default" class="input_import" /></p>
-                    <div id="importing_default" style="display:none" class="importing"><img src="[% interface %]/[% theme %]/img/loading-small.gif" alt="" /><span class="importing_msg"></span></div>
+                    <div id="importing_default" style="display:none" class="importing"><img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /><span class="importing_msg"></span></div>
                  </div>
                  <div class="modal-footer">
-                  <button type="submit" class="btn">Import</button>
+                  <button type="submit" class="btn btn-default">Import</button>
                    <button class="btn btn-link" data-dismiss="modal" aria-hidden="true">Close</button>
                  </div>
                </form>
+              </div>
+              </div>
              </div>
            </div>
          </td>
@@ -201,10 +209,10 @@
      [% FOREACH loo IN frameworks %]
          <tr>
              <td>[% loo.frameworkcode %]</td>
-            <td>[% loo.frameworktext %]</td>
+            <td>[% loo.frameworktext |html %]</td>
              <td>
                <div class="dropdown">
-                <a class="btn btn-mini dropdown-toggle" id="frameworkactions[% loo.frameworkcode %]" role="button" data-toggle="dropdown" href="#">
+                <a class="btn btn-default btn-xs dropdown-toggle" id="frameworkactions[% loo.frameworkcode %]" role="button" data-toggle="dropdown" href="#">
                    Actions <b class="caret"></b>
                  </a>
                  <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="frameworkactions[% loo.frameworkcode %]">
@@ -217,10 +225,12 @@
                    <li><a href="#" data-toggle="modal" data-target="#importModal_[% loo.frameworkcode %][% loop.count %]" title="Import framework structure (fields, subfields) from a spreadsheet file (.csv, .xml, .ods)"><i class="fa fa-download"></i> Import</a></li>
                  </ul>
                  <!-- Modal to export other framework -->
-                <div class="modal hide" id="exportModal_[% loo.frameworkcode %][% loop.count %]" tabindex="-1" role="dialog" aria-labelledby="exportLabelexportModal_[% loo.frameworkcode %][% loop.count %]" aria-hidden="true">
+                <div class="modal" id="exportModal_[% loo.frameworkcode %][% loop.count %]" tabindex="-1" role="dialog" aria-labelledby="exportLabelexportModal_[% loo.frameworkcode %][% loop.count %]" aria-hidden="true">
+                  <div class="modal-dialog">
+                  <div class="modal-content">
                    <div class="modal-header">
                      <button type="button" class="closebtn" data-dismiss="modal" aria-hidden="true">×</button>
-                    <h3 id="exportLabelexportModal_[% loo.frameworkcode %][% loop.count %]">Export [% loo.frameworktext %] framework</h3>
+                    <h3 id="exportLabelexportModal_[% loo.frameworkcode %][% loop.count %]">Export [% loo.frameworktext |html %] framework</h3>
                    </div>
                    <form action="import_export_framework.pl" name="form_[% loo.frameworkcode %]" method="get" target="_blank"  class="form_export">
                      <div class="modal-body">
@@ -232,14 +242,18 @@
                        </fieldset>
                      </div>
                      <div class="modal-footer">
-                      <button type="submit" class="btn">Export</button>
+                      <button type="submit" class="btn btn-default">Export</button>
                        <button class="btn btn-link" data-dismiss="modal" aria-hidden="true">Cancel</button>
                      </div>
                    </form>
+                  </div>
+                  </div>
                  </div>
  
                  <!-- Modal to import other framework -->
-                <div class="modal hide" id="importModal_[% loo.frameworkcode %][% loop.count %]" tabindex="-1" role="dialog" aria-labelledby="importLabelexportModal_[% loo.frameworkcode %][% loop.count %]" aria-hidden="true">
+                <div class="modal" id="importModal_[% loo.frameworkcode %][% loop.count %]" tabindex="-1" role="dialog" aria-labelledby="importLabelexportModal_[% loo.frameworkcode %][% loop.count %]" aria-hidden="true">
+                  <div class="modal-dialog">
+                  <div class="modal-content">
                    <div class="modal-header">
                      <button type="button" class="closebtn" data-dismiss="modal" aria-hidden="true">×</button>
                      <h3 id="importLabelexportModal_[% loo.frameworkcode %][% loop.count %]">Import [% loo.frameworkcode %] framework structure (fields and subfields) from a spreadsheet file (.csv, .xml, .ods)</h3>
@@ -249,13 +263,15 @@
                        <input type="hidden" name="frameworkcode" value="[% loo.frameworkcode %]" />
                        <input type="hidden" name="action" value="import" />
                        <p><label for="file_import_[% loo.frameworkcode %]">Upload file:</label> <input type="file" name="file_import_[% loo.frameworkcode %]" id="file_import_[% loo.frameworkcode %]" class="input_import" /></p>
-                      <div id="importing_[% loo.frameworkcode %]" style="display:none" class="importing"><img src="[% interface %]/[% theme %]/img/loading-small.gif" alt="" /><span class="importing_msg"></span></div>
+                      <div id="importing_[% loo.frameworkcode %]" style="display:none" class="importing"><img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /><span class="importing_msg"></span></div>
                      </div>
                      <div class="modal-footer">
-                      <button type="submit" class="btn">Import</button>
+                      <button type="submit" class="btn btn-default">Import</button>
                        <button class="btn btn-link" data-dismiss="modal" aria-hidden="true">Close</button>
                      </div>
                    </form>
+                  </div>
+                  </div>
                  </div>
                </div>
              </td>