http://demo.mykoha.co.nz/cgi-bin/koha/opac-search.pl?idx=kw&q=a&count=50%22%27%3Ch1%3Etest%3C/h1%3E&sort_by=acqdate_dsc&format=rss2 If you look at the source you will see <opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage>
Created attachment 23164 [details] [review] Bug 11307 : Potential XSS attack in rss feed To test: 1/ Craft a url like /cgi-bin/koha/opac-search.pl?q=a&count=50"'<h1>test</h1>&sort_by=acqdate_dsc&format=rss2 2/ look at the source, notice <opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage> 3/ apply the patch, and reload url 4/ source now contains <opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage>
Created attachment 23167 [details] [review] Bug 11307 : Follow up for bootstrap theme (master and 3.14.x only) To test: Same as first patch, but using bootstrap theme
Created attachment 23169 [details] [review] Bug 11307 : Potential XSS attack in rss feed To test: 1/ Craft a url like /cgi-bin/koha/opac-search.pl?q=a&count=50"'<h1>test</h1>&sort_by=acqdate_dsc&format=rss2 2/ look at the source, notice <opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage> 3/ apply the patch, and reload url 4/ source now contains <opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage> Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Created attachment 23170 [details] [review] Bug 11307 : Follow up for bootstrap theme (master and 3.14.x only) To test: Same as first patch, but using bootstrap theme Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Tested according to test plan given in comment #1 for prog and bootstrap themes.
Created attachment 23175 [details] [review] [PASSED QA] Bug 11307 : Potential XSS attack in rss feed To test: 1/ Craft a url like /cgi-bin/koha/opac-search.pl?q=a&count=50"'<h1>test</h1>&sort_by=acqdate_dsc&format=rss2 2/ look at the source, notice <opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage> 3/ apply the patch, and reload url 4/ source now contains <opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage> Signed-off-by: Mark Tompsett <mtompset@hotmail.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Created attachment 23176 [details] [review] [PASSED QA] Bug 11307 : Follow up for bootstrap theme (master and 3.14.x only) To test: Same as first patch, but using bootstrap theme Signed-off-by: Mark Tompsett <mtompset@hotmail.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
All works as expected, passes QA script.
Pushed to master and 3.14.x. Thanks, Chris!
Patches will be in 3.14.1
This patch has been pushed to 3.12.x, will be in 3.12.8. Thanks Chris!