From 1e0ff0f9c2cd3ddbdb8c3d846730606fc0b0fd5c Mon Sep 17 00:00:00 2001 From: Ozzieisaacs Date: Wed, 3 Nov 2021 18:16:15 +0400 Subject: [PATCH 1/9] Fix #2045 ("fetch metadata" update appends to the existing tags instead or replacing them) --- cps/static/js/get_meta.js | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/cps/static/js/get_meta.js b/cps/static/js/get_meta.js index f64be699..51ab740d 100644 --- a/cps/static/js/get_meta.js +++ b/cps/static/js/get_meta.js @@ -28,14 +28,17 @@ $(function () { function populateForm (book) { tinymce.get("description").setContent(book.description); - var uniqueTags = []; + var uniqueTags = $.map($("#tags").val().split(","), $.trim); + if ( uniqueTags.length == 1 && uniqueTags[0] == "") { + uniqueTags = []; + } $.each(book.tags, function(i, el) { if ($.inArray(el, uniqueTags) === -1) uniqueTags.push(el); }); var ampSeparatedAuthors = (book.authors || []).join(" & "); $("#bookAuthor").val(ampSeparatedAuthors); $("#book_title").val(book.title); - $("#tags").val(uniqueTags.join(",")); + $("#tags").val(uniqueTags.join(", ")); $("#rating").data("rating").setValue(Math.round(book.rating)); if(book.cover !== null){ $(".cover img").attr("src", book.cover); From 61deda107629214e7e7eebdaa759cdb526d52128 Mon Sep 17 00:00:00 2001 From: Ozzieisaacs Date: Wed, 3 Nov 2021 18:29:30 +0400 Subject: [PATCH 2/9] Updated security history --- SECURITY.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index dc763184..afaf9b0b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -16,14 +16,14 @@ To receive fixes for security vulnerabilities it is required to always upgrade t | V 0.6.7 |Hardcoded secret key for sessions |CVE-2020-12627 | | V 0.6.13|Calibre-Web Metadata cross site scripting |CVE-2021-25964| | V 0.6.13|Name of Shelves are only visible to users who can access the corresponding shelf Thanks to @ibarrionuevo|| -| V 0.6.13|JavaScript could get executed in the description field. Thanks to @ranjit-git || +| V 0.6.13|JavaScript could get executed in the description field. Thanks to @ranjit-git and Hagai Wechsler (WhiteSource)|| | V 0.6.13|JavaScript could get executed in a custom column of type "comment" field || | V 0.6.13|JavaScript could get executed after converting a book to another format with a title containing javascript code|| | V 0.6.13|JavaScript could get executed after converting a book to another format with a username containing javascript code|| | V 0.6.13|JavaScript could get executed in the description series, categories or publishers title|| | V 0.6.13|JavaScript could get executed in the shelf title|| | V 0.6.13|Login with the old session cookie after logout. Thanks to @ibarrionuevo|| -| V 0.6.14|CSRF was possible. Thanks to @mik317 || +| V 0.6.14|CSRF was possible. Thanks to @mik317 and Hagai Wechsler (WhiteSource) || | V 0.6.14|Cross-Site Scripting vulnerability on typeahead inputs. Thanks to @notdodo|| From d72210c6aedd03ee589ad06aa3ab57ec6ed049f2 Mon Sep 17 00:00:00 2001 From: Ozzieisaacs Date: Wed, 3 Nov 2021 19:05:24 +0400 Subject: [PATCH 3/9] Exclude upload rights visibility if upload is not activated --- cps/templates/admin.html | 4 ++++ cps/templates/user_edit.html | 2 ++ 2 files changed, 6 insertions(+) diff --git a/cps/templates/admin.html b/cps/templates/admin.html index 9a941594..f99c0938 100644 --- a/cps/templates/admin.html +++ b/cps/templates/admin.html @@ -16,7 +16,9 @@ {{_('Downloads')}} {{_('Admin')}} {{_('Password')}} + {% if config.config_upload %} {{_('Upload')}} + {% endif %} {{_('Download')}} {{_('View Books')}} {{_('Edit')}} @@ -32,7 +34,9 @@ {{user.downloads.count()}} {{ display_bool_setting(user.role_admin()) }} {{ display_bool_setting(user.role_passwd()) }} + {% if config.config_upload %} {{ display_bool_setting(user.role_upload()) }} + {% endif %} {{ display_bool_setting(user.role_download()) }} {{ display_bool_setting(user.role_viewer()) }} {{ display_bool_setting(user.role_edit()) }} diff --git a/cps/templates/user_edit.html b/cps/templates/user_edit.html index a250c246..c32ab660 100644 --- a/cps/templates/user_edit.html +++ b/cps/templates/user_edit.html @@ -101,10 +101,12 @@ + {% if config.config_upload %}
+ {% endif %}
From ecc5cb167e1a584994861d52f206f82d92bbb33f Mon Sep 17 00:00:00 2001 From: Ozzieisaacs Date: Wed, 3 Nov 2021 20:32:17 +0400 Subject: [PATCH 4/9] Upload setting in user template only visible if upload enabled Delete book setting only visible if edit book setting is ticked --- cps/templates/config_view_edit.html | 12 ++++++++---- cps/templates/user_edit.html | 30 +++++++++++++++-------------- 2 files changed, 24 insertions(+), 18 deletions(-) diff --git a/cps/templates/config_view_edit.html b/cps/templates/config_view_edit.html index ebfb5362..32509e88 100644 --- a/cps/templates/config_view_edit.html +++ b/cps/templates/config_view_edit.html @@ -95,17 +95,21 @@
+ {% if config.config_upload %}
+ {% endif %}
- +
-
- - +
+
+ + +
diff --git a/cps/templates/user_edit.html b/cps/templates/user_edit.html index c32ab660..2729a168 100644 --- a/cps/templates/user_edit.html +++ b/cps/templates/user_edit.html @@ -108,24 +108,26 @@
{% endif %}
- +
-
- - +
+
+ + +
- {% if not content.role_anonymous() %} -
- - -
-
- - -
- {% endif %} + {% if not content.role_anonymous() %} +
+ + +
+
+ + +
{% endif %} + {% endif %} {% if kobo_support and not content.role_anonymous() %}
From 42cc13d1e2c09c87047518453f00f55318d1afc8 Mon Sep 17 00:00:00 2001 From: Ozzieisaacs Date: Wed, 3 Nov 2021 21:07:16 +0400 Subject: [PATCH 5/9] Mark which functions are selected on list pages --- cps/static/js/filter_grid.js | 11 +++++++++++ cps/static/js/filter_list.js | 13 ++++++++++++- cps/templates/grid.html | 12 ++++++------ cps/templates/list.html | 10 +++++----- 4 files changed, 34 insertions(+), 12 deletions(-) diff --git a/cps/static/js/filter_grid.js b/cps/static/js/filter_grid.js index d84cf57a..14d60f27 100644 --- a/cps/static/js/filter_grid.js +++ b/cps/static/js/filter_grid.js @@ -30,6 +30,9 @@ $("#desc").click(function() { if (direction === 0) { return; } + $("#asc").removeClass("active"); + $("#desc").addClass("active"); + var page = $(this).data("id"); $.ajax({ method:"post", @@ -50,6 +53,9 @@ $("#asc").click(function() { if (direction === 1) { return; } + $("#desc").removeClass("active"); + $("#asc").addClass("active"); + var page = $(this).data("id"); $.ajax({ method:"post", @@ -66,6 +72,8 @@ $("#asc").click(function() { }); $("#all").click(function() { + $(".char").removeClass("active"); + $("#all").addClass("active"); // go through all elements and make them visible $list.isotope({ filter: function() { return true; @@ -74,6 +82,9 @@ $("#all").click(function() { }); $(".char").click(function() { + $(".char").removeClass("active"); + $(this).addClass("active"); + $("#all").removeClass("active"); var character = this.innerText; $list.isotope({ filter: function() { return this.attributes["data-id"].value.charAt(0).toUpperCase() === character; diff --git a/cps/static/js/filter_list.js b/cps/static/js/filter_list.js index e76e6147..747f98fa 100644 --- a/cps/static/js/filter_list.js +++ b/cps/static/js/filter_list.js @@ -19,6 +19,7 @@ var direction = $("#asc").data('order'); // 0=Descending order; 1= ascending or var sort = 0; // Show sorted entries $("#sort_name").click(function() { + $("#sort_name").toggleClass("active"); var className = $("h1").attr("Class") + "_sort_name"; var obj = {}; obj[className] = sort; @@ -68,6 +69,9 @@ $("#desc").click(function() { if (direction === 0) { return; } + $("#asc").removeClass("active"); + $("#desc").addClass("active"); + var page = $(this).data("id"); $.ajax({ method:"post", @@ -112,10 +116,12 @@ $("#desc").click(function() { $("#asc").click(function() { - if (direction === 1) { return; } + $("#desc").removeClass("active"); + $("#asc").addClass("active"); + var page = $(this).data("id"); $.ajax({ method:"post", @@ -159,6 +165,8 @@ $("#asc").click(function() { }); $("#all").click(function() { + $("#all").addClass("active"); + $(".char").removeClass("active"); var cnt = $("#second").contents(); $("#list").append(cnt); // Find count of middle element @@ -176,6 +184,9 @@ $("#all").click(function() { }); $(".char").click(function() { + $(".char").removeClass("active"); + $(this).addClass("active"); + $("#all").removeClass("active"); var character = this.innerText; var count = 0; var index = 0; diff --git a/cps/templates/grid.html b/cps/templates/grid.html index b1cc64ec..13a59b4a 100644 --- a/cps/templates/grid.html +++ b/cps/templates/grid.html @@ -4,20 +4,20 @@ {% if entries[0] %} diff --git a/cps/templates/list.html b/cps/templates/list.html index 48b90c8a..71dbea11 100644 --- a/cps/templates/list.html +++ b/cps/templates/list.html @@ -5,16 +5,16 @@