Bugzilla – Attachment 130933 Details for
Bug 26102
Javascript injection in intranet search
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 26102: [19.11] Prevent XSS when To.json is used: authorities/blinddetail-biblio-search.tt
Bug-26102-1911-Prevent-XSS-when-Tojson-is-used-aut.patch (text/plain), 2.15 KB, created by
Jonathan Druart
on 2022-02-21 09:23:14 UTC
(
hide
)
Description:
Bug 26102: [19.11] Prevent XSS when To.json is used: authorities/blinddetail-biblio-search.tt
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2022-02-21 09:23:14 UTC
Size:
2.15 KB
patch
obsolete
>From 80558279b508c7223fe0c283034968d44fee21ec Mon Sep 17 00:00:00 2001 >From: Owen Leonard <oleonard@myacpl.org> >Date: Tue, 11 Aug 2020 12:41:13 +0000 >Subject: [PATCH] Bug 26102: [19.11] Prevent XSS when To.json is used: > authorities/blinddetail-biblio-search.tt > >Test the process of searching for and selecting an authority record for >use in the basic MARC editor. >--- > .../authorities/blinddetail-biblio-search.tt | 13 +++++++------ > 1 file changed, 7 insertions(+), 6 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt >index 6822225ea90..6e360fc5509 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt >@@ -1,3 +1,4 @@ >+[% USE To %] > [% SET footerjs = 1 %] > [% INCLUDE 'doc-head-open.inc' %] > <title>Koha › Authority details</title> >@@ -30,12 +31,12 @@ > var new_line = ""; > [% ELSE %] > var new_line = " >- [%- FOREACH SUBFIELD_LOO IN SUBFIELD_LOOP -%]â¡ >- [%- SUBFIELD_LOO.marc_subfield |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r ') | html -%] >- [%- FOREACH marc_value IN SUBFIELD_LOO.marc_values -%] >- [%- marc_value |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html -%] >- [%- END -%] >- [%- END -%]â¡9[% authid | html %]"; >+ [%- FOREACH SUBFIELD_LOO IN SUBFIELD_LOOP -%]â¡ >+ [%- To.json( SUBFIELD_LOO.marc_subfield ) | html -%] >+ [%- FOREACH marc_value IN SUBFIELD_LOO.marc_values -%] >+ [%- To.json( marc_value ) | html -%] >+ [%- END -%] >+ [%- END -%]â¡9[% authid | html %]"; > [% END %] > RancorReplaceField( new_line, "[% indicator1 | html %]", "[% indicator2 | html %]" ); > [% ELSE %] >-- >2.25.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 26102
:
107579
|
108083
|
108084
|
108085
|
108086
|
108087
|
108088
|
108089
|
108090
|
119643
|
119644
|
119645
|
119646
|
119647
|
119648
|
119649
|
127669
|
127670
|
127671
|
127672
|
127673
|
127674
|
127675
|
128716
|
128717
|
128718
|
128719
|
128720
|
128721
|
128722
|
130931
|
130932
|
130933
|
130934
|
130935
|
130936
|
130999
|
131000
|
131001
|
131002
|
131003
|
131004