From 4cabb6155de7507c78e754d5035e450c391feaa1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A8re=20S=C3=A9bastien=20Marie?= Date: Sun, 4 Dec 2011 18:14:09 +0100 Subject: [PATCH] Bug 7316 - Missing escaping in search results Two parameters are now escaped in title (html element): - query_desc - limit_desc This is a security correction against XSS. --- .../prog/en/modules/catalogue/results.tt | 2 +- .../prog/en/modules/opac-results-grouped.tt | 2 +- .../opac-tmpl/prog/en/modules/opac-results.tt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt index 2bed51c..9b4f01f 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt @@ -1,5 +1,5 @@ [% INCLUDE 'doc-head-open.inc' %] -Koha › Catalog › [% IF ( searchdesc ) %]Results of Search [% IF ( query_desc ) %]for '[% query_desc %]'[% END %][% IF ( limit_desc ) %] with limit(s): '[% limit_desc %]'[% END %][% ELSE %]You did not specify any search criteria[% END %] +Koha › Catalog › [% IF ( searchdesc ) %]Results of Search [% IF ( query_desc ) %]for '[% query_desc | html %]'[% END %][% IF ( limit_desc ) %] with limit(s): '[% limit_desc | html %]'[% END %][% ELSE %]You did not specify any search criteria[% END %] [% INCLUDE 'doc-head-close.inc' %]