Last modified by Super Admin on 2026/03/22 00:39

From version Icon 26.1 Icon
edited by Super Admin
on 2026/03/10 22:25
Change comment: There is no comment for this version
To version Icon 28.1 Icon
edited by Super Admin
on 2026/03/12 17:54
Change comment: There is no comment for this version

Summary

Details

Icon Page properties
Content
... ... @@ -37,16 +37,6 @@
37 37   #set($newObj = $newDoc.getObject('SeitokaiCode.SchoolClass', $objNum))
38 38   $newObj.set('schoolCode', $schoolCode)
39 39   $newObj.set('schoolName', $schoolName)
40 - ## 現在の年度を初期値として設定(4月始まり)
41 - #set($now = $datetool.date)
42 - #set($currentYear = $datetool.format('yyyy', $now))
43 - #set($currentMonth = $mathtool.toInteger($datetool.format('MM', $now)))
44 - #if($currentMonth >= 4)
45 - #set($fiscalYear = $currentYear)
46 - #else
47 - #set($fiscalYear = $mathtool.sub($mathtool.toInteger($currentYear), 1).toString())
48 - #end
49 - $newObj.set('fiscalYear', $fiscalYear)
50 50   $newDoc.saveWithProgrammingRights('学校ページを新規作成')
51 51   ## 作成後にビューにリダイレクト
52 52   $response.sendRedirect($xwiki.getURL($targetPage, 'view'))
... ... @@ -118,6 +118,13 @@
118 118  
119 119  <script>
120 120  (function() {
111 + // XSSエスケープ関数
112 + function escapeHtml(s) {
113 + var div = document.createElement('div');
114 + div.appendChild(document.createTextNode(s));
115 + return div.innerHTML;
116 + }
117 +
121 121   // 学校マスターデータをJSON APIから取得
122 122   var schools = [];
123 123   var schoolsLoaded = false;
... ... @@ -161,11 +161,11 @@
161 161   var li = document.createElement('li');
162 162   li.className = 'search-result-item';
163 163   li.innerHTML =
164 - '<div class="search-result-name">' + s.name + '</div>' +
161 + '<div class="search-result-name">' + escapeHtml(s.name) + '</div>' +
165 165   '<div class="search-result-info">' +
166 - s.pref + ' ' + s.city + ' ・ ' + s.type + '(' + s.est + ')' +
163 + escapeHtml(s.pref) + ' ' + escapeHtml(s.city) + ' ・ ' + escapeHtml(s.type) + '(' + escapeHtml(s.est) + ')' +
167 167   '</div>' +
168 - '<div class="search-result-code">' + s.code + '</div>';
165 + '<div class="search-result-code">' + escapeHtml(s.code) + '</div>';
169 169   li.onclick = function() { selectSchool(s); };
170 170   resultsList.appendChild(li);
171 171   });