Bug 8973 - HTML and URL escape missing in OPAC templates
Summary: HTML and URL escape missing in OPAC templates
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: 3.6
Hardware: All All
: P5 - low normal
Assignee: Fridolin Somers
QA Contact: Paul Poulain
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-10-26 08:48 UTC by Fridolin Somers
Modified: 2013-12-05 20:01 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Proposed patch (3.56 KB, patch)
2012-10-26 08:52 UTC, Fridolin Somers 		Details | Diff | Splinter Review
[SIGNED-OFF] Bug 8973: HTML and URL escape missing in OPAC templates (3.67 KB, patch)
2012-10-29 15:20 UTC, Owen Leonard 		Details | Diff | Splinter Review
Bug 8973 [3.6.x] HTML and URL escape missing in OPAC templates (2.52 KB, patch)
2012-11-19 13:54 UTC, Owen Leonard 		Details | Diff | Splinter Review
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Fridolin Somers 2012-10-26 08:48:27 UTC 
In a few templates variables, the title or author are not html or url escaped.
This causes crash of email sharing for example (in opac-details.tt) when title contains a ".
Comment 1 Fridolin Somers 2012-10-26 08:52:08 UTC Comment hidden (obsolete)
Comment 2 Owen Leonard 2012-10-29 15:20:13 UTC Comment hidden (obsolete)
Comment 3 Paul Poulain 2012-10-30 17:23:06 UTC 
QA comment: 
 * 3 lines patch that fix a  bug that could even be exploited for XSS injection
 * passes koha-qa.pl
 * no string change

passed QA
Comment 4 Paul Poulain 2012-10-30 17:23:31 UTC 
Patch pushed to master
Comment 5 Chris Cormack 2012-10-30 22:15:05 UTC 
Pushed to 3.8.x will be in 3.8.7
Comment 6 Liz Rea 2012-11-19 02:12:26 UTC 
This does not apply for 3.6.x, please send a 3.6.x patch if it is needed.
Comment 7 Owen Leonard 2012-11-19 13:54:14 UTC 
Created attachment 13514 [details] [review]
Bug 8973 [3.6.x] HTML and URL escape missing in OPAC templates

Adding HTML filter to some template variables which require them.
This patch is for 3.6.x, based on Fridolyn SOMERS patch for master.
Comment 8 Fridolin Somers 2012-11-20 08:27:43 UTC 
I wanted to signoff 3.6 patch, but patch is already pushed in 3.6.x :
http://git.koha-community.org/gitweb/?p=koha.git;a=commit;h=b28598369ac95a971293ec79157593bb22b38ee7