Reported by Dionach.
Created attachment 53944 [details] [review] Bug 17038: Fix XSS in catalogue/search.pl Test plan: Search for something like: \";alert(1)//135 => Without this patch you will see the alert => With this patch, no more alert Note that this fix the parameters idx, q and op
Created attachment 53985 [details] [review] Bug 17038: Fix XSS in catalogue/search.pl Test plan: Search for something like: \";alert(1)//135 => Without this patch you will see the alert => With this patch, no more alert Note that this fix the parameters idx, q and op Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Created attachment 54111 [details] [review] [PASSED QA] Bug 17038: Fix XSS in catalogue/search.pl Test plan: Search for something like: \";alert(1)//135 => Without this patch you will see the alert => With this patch, no more alert Note that this fix the parameters idx, q and op Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Pushed to master for 16.11, thanks Jonathan!
Pushed to 3.20.x will be in 3.20.14, leaving as pushed to master for the other rmaints
Pushed in 16.05. Will be in 16.05.03.
Pushed to 3.22.x, will be in 3.22.10