Bug 7316 - Missing escaping in search results
Summary: Missing escaping in search results
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: 3.6
Hardware: All All
: PATCH-Sent (DO NOT USE) critical (vote)
Assignee: Sébastien Marie
QA Contact: Ian Walls
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-12-04 17:26 UTC by Sébastien Marie
Modified: 2019-06-27 09:24 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Missing escaping in search results (3.34 KB, patch)
2011-12-04 17:27 UTC, Sébastien Marie
Details | Diff | Splinter Review
Signed-off patch (3.44 KB, patch)
2011-12-05 19:36 UTC, Owen Leonard
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Sébastien Marie 2011-12-04 17:26:13 UTC
In opac (and intranet), in search results, two parameters need escaping in title (html element):
 - query_desc
 - limit_desc

Impacted templates:
 koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
 koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tt
 koha-tmpl/opac-tmpl/prog/en/modules/opac-results.tt

This is a security issue, as it could be used to perform XSS (I have tested).
Comment 1 Sébastien Marie 2011-12-04 17:27:07 UTC Comment hidden (obsolete)
Comment 2 Owen Leonard 2011-12-05 19:36:03 UTC
Created attachment 6583 [details] [review]
Signed-off patch
Comment 3 Paul Poulain 2011-12-09 15:02:18 UTC
patch pushed, please test
Comment 4 Jared Camins-Esakov 2012-05-23 12:29:36 UTC
Included in the 3.6 branch prior to 3.6.4.