Bugzilla – Attachment 12876 Details for
Bug 3652
XSS vulnerabilities
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Fixing XSS vulnerability in opac-search
0001-bug-3652-fixing-XSS-vulnerabilities-in-opac-search.patch (text/plain), 2.93 KB, created by
Chris Hall
on 2012-10-17 07:02:52 UTC
(
hide
)
Description:
Fixing XSS vulnerability in opac-search
Filename:
MIME Type:
Creator:
Chris Hall
Created:
2012-10-17 07:02:52 UTC
Size:
2.93 KB
patch
obsolete
>From a5cc5dd85e41ce5362574abb9df08b7ad9f8eb7b Mon Sep 17 00:00:00 2001 >From: Chris Hall <chrish@catalyst.net.nz> >Date: Wed, 17 Oct 2012 14:32:19 +1300 >Subject: [PATCH] bug 3652 fixing XSS vulnerabilities in opac-search > >--- > koha-tmpl/opac-tmpl/prog/en/modules/opac-detail.tt | 2 +- > .../prog/en/modules/opac-results-grouped.tt | 2 +- > .../opac-tmpl/prog/en/modules/opac-results.tt | 2 +- > 3 files changed, 3 insertions(+), 3 deletions(-) > >diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/opac-detail.tt b/koha-tmpl/opac-tmpl/prog/en/modules/opac-detail.tt >index f740488..39a4e95 100644 >--- a/koha-tmpl/opac-tmpl/prog/en/modules/opac-detail.tt >+++ b/koha-tmpl/opac-tmpl/prog/en/modules/opac-detail.tt >@@ -63,7 +63,7 @@ > widgets : ['zebra'], > sortList: [[0,0]] > }); >- [% IF ( query_desc ) %][% IF ( OpacHighlightedWords ) %]var query_desc = "[% query_desc |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]"; >+ [% IF ( query_desc ) %][% IF ( OpacHighlightedWords ) %]var query_desc = "[% query_desc |replace("'", "\'") |replace('\n', '\\n') |replace('\r', '\\r') |html %]"; > q_array = query_desc.split(" "); > highlightOn(); > $("#highlight_toggle_on" ).hide().click(function() {highlightOn() ; return false;}); >diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tt b/koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tt >index 86e1a08..222d841 100644 >--- a/koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tt >+++ b/koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tt >@@ -62,7 +62,7 @@ $(document).ready(function(){ > return false; > }); > [% IF ( query_desc ) %] >- var query_desc = "[% query_desc |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]"; >+ var query_desc = "[% query_desc |replace("'", "\'") |replace('\n', '\\n') |replace('\r', '\\r') |html %]"; > q_array = query_desc.split(" "); > // ensure that we don't have "" at the end of the array, which can > // break the highlighter >diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/opac-results.tt b/koha-tmpl/opac-tmpl/prog/en/modules/opac-results.tt >index a3c09e2..95ed896 100644 >--- a/koha-tmpl/opac-tmpl/prog/en/modules/opac-results.tt >+++ b/koha-tmpl/opac-tmpl/prog/en/modules/opac-results.tt >@@ -207,7 +207,7 @@ $(document).ready(function(){ > [% END %] > $("#holdDetails").hide(); > >-[% IF ( query_desc ) %][% IF ( OpacHighlightedWords ) %]var query_desc = "[% query_desc |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]"; >+[% IF ( query_desc ) %][% IF ( OpacHighlightedWords ) %]var query_desc = "[% query_desc |replace("'", "\'") |replace('\n', '\\n') |replace('\r', '\\r') |html %]"; > q_array = query_desc.split(" "); > // ensure that we don't have "" at the end of the array, which can > // break the highlighter >-- >1.7.4.1 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 3652
:
1482
|
2364
|
2784
|
2785
|
2838
|
12728
|
12729
|
12730
|
12737
|
12738
|
12740
|
12741
|
12807
|
12808
|
12809
|
12820
|
12823
|
12835
|
12836
|
12876
|
12926