Bug 7316

Summary: Missing escaping in search results
Product: Koha Reporter: Sébastien Marie <semarie>
Component: Architecture, internals, and plumbingAssignee: Sébastien Marie <semarie>
Status: CLOSED FIXED QA Contact: Ian Walls <koha.sekjal>
Severity: critical    
Priority: PATCH-Sent (DO NOT USE) CC: paul.poulain
Version: 3.6   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Missing escaping in search results
Signed-off patch

Description Sébastien Marie 2011-12-04 17:26:13 UTC
In opac (and intranet), in search results, two parameters need escaping in title (html element):
 - query_desc
 - limit_desc

Impacted templates:
 koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
 koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tt
 koha-tmpl/opac-tmpl/prog/en/modules/opac-results.tt

This is a security issue, as it could be used to perform XSS (I have tested).
Comment 1 Sébastien Marie 2011-12-04 17:27:07 UTC Comment hidden (obsolete)
Comment 2 Owen Leonard 2011-12-05 19:36:03 UTC
Created attachment 6583 [details] [review]
Signed-off patch
Comment 3 Paul Poulain 2011-12-09 15:02:18 UTC
patch pushed, please test
Comment 4 Jared Camins-Esakov 2012-05-23 12:29:36 UTC
Included in the 3.6 branch prior to 3.6.4.