/cgi-bin/koha/opac-imageviewer.pl?biblionumber=14&imagenumber=7%22%3e%3c%73%43%72%49%70%54%3e%61%6c%65%72%74%28%38%31%38%34%32%29%3c%2f%73%43%72%49%70%54%3e
Working on this now
Created attachment 53622 [details] [review] Bug 16958: Fix XSS in opac-imageviewer.pl Test plan: Trigger /opac-imageviewer.pl?biblionumber=14&imagenumber=7"><sCrIpT>alert(42)<%2fsCrIpT> => Without this patch you will see the JS alert => With this patch applied you won't see it
Created attachment 53633 [details] [review] Bug 16958: Fix XSS in opac-imageviewer.pl Test plan: Trigger /opac-imageviewer.pl?biblionumber=14&imagenumber=7"><sCrIpT>alert(42)<%2fsCrIpT> => Without this patch you will see the JS alert => With this patch applied you won't see it Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Created attachment 53640 [details] [review] Bug 16958: Fix XSS in opac-imageviewer.pl Test plan: Trigger /opac-imageviewer.pl?biblionumber=14&imagenumber=7"><sCrIpT>alert(42)<%2fsCrIpT> => Without this patch you will see the JS alert => With this patch applied you won't see it Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Pushed to master for 16.11, thanks Jonathan!
Pushed in 16.05. Will be in 16.05.02.
Pushed to 3.20.x will be in 3.20.14
Patch pushed to 3.22.x, will be in 3.22.10