Bugzilla – Attachment 131004 Details for
Bug 26102
Javascript injection in intranet search
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 26102: [19.11] Prevent XSS when To.json is used: unimarc_field_4XX.tt
Bug-26102-1911-Prevent-XSS-when-Tojson-is-used-uni.patch (text/plain), 6.88 KB, created by
Wainui Witika-Park
on 2022-02-22 00:51:47 UTC
(
hide
)
Description:
Bug 26102: [19.11] Prevent XSS when To.json is used: unimarc_field_4XX.tt
Filename:
MIME Type:
Creator:
Wainui Witika-Park
Created:
2022-02-22 00:51:47 UTC
Size:
6.88 KB
patch
obsolete
>From 35ab9a4a3289737f69972c877779a4b997f1cfff Mon Sep 17 00:00:00 2001 >From: Owen Leonard <oleonard@myacpl.org> >Date: Tue, 11 Aug 2020 17:26:18 +0000 >Subject: [PATCH] Bug 26102: [19.11] Prevent XSS when To.json is used: > unimarc_field_4XX.tt > >To test, edit a MARC framework to link a subfield to the >unimarc_field_4XX.tt. The process of triggering the plugin and selecting >a search result from the plugin popup should work correctly. > >Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> >--- > .../cataloguing/value_builder/unimarc_field_4XX.tt | 35 +++++++++++----------- > 1 file changed, 18 insertions(+), 17 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt >index 2268a0953cc..6c1a912df9e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt >@@ -1,3 +1,4 @@ >+[% USE To %] > [% SET footerjs = 1 %] > [% INCLUDE 'doc-head-open.inc' %] > <title>Koha › Cataloging › 4XX plugin</title> >@@ -167,55 +168,55 @@ > var subfield = subfields[i+1]; > > if(code.value == '9'){ >- subfield.value = "[% subfield_value_9 |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"; >+ subfield.value = "[% To.json( subfield_value_9 ) | html %]"; > } > if(code.value == '0'){ >- subfield.value = "[% subfield_value_0 |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"; >+ subfield.value = "[% To.json( subfield_value_0 ) | html %]"; > } > if(code.value == 'a'){ >- subfield.value = "[% subfield_value_a |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"; >+ subfield.value = "[% To.json( subfield_value_a ) | html %]"; > } > if(code.value == 'c'){ >- subfield.value = "[% subfield_value_c |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"; >+ subfield.value = "[% To.json( subfield_value_c ) | html %]"; > } > if(code.value == 'd'){ >- subfield.value = "[% subfield_value_d |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"; >+ subfield.value = "[% To.json( subfield_value_d ) | html %]"; > } > if(code.value == 'e'){ >- subfield.value = "[% subfield_value_e |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"; >+ subfield.value = "[% To.json( subfield_value_e ) | html %]"; > } > if(code.value == 'h'){ >- subfield.value = "[% subfield_value_h |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"; >+ subfield.value = "[% To.json( subfield_value_h ) | html %]"; > } > if(code.value == 'i'){ >- subfield.value = "[% subfield_value_i |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"; >+ subfield.value = "[% To.json( subfield_value_i ) | html %]"; > } > if(code.value == 'l'){ >- subfield.value = "[% subfield_value_l |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"; >+ subfield.value = "[% To.json( subfield_value_l ) | html %]"; > } > if(code.value == 'n'){ >- subfield.value = "[% subfield_value_n |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"; >+ subfield.value = "[% To.json( subfield_value_n ) | html %]"; > } > if(code.value == 'o'){ >- subfield.value = "[% subfield_value_o |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"; >+ subfield.value = "[% To.json( subfield_value_o ) | html %]"; > } > if(code.value == 'p'){ >- subfield.value = "[% subfield_value_p |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"; >+ subfield.value = "[% To.json( subfield_value_p ) | html %]"; > } > if(code.value == 't'){ >- subfield.value = "[% subfield_value_t |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"; >+ subfield.value = "[% To.json( subfield_value_t ) | html %]"; > } > if(code.value == 'u'){ >- subfield.value = "[% subfield_value_u |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"; >+ subfield.value = "[% To.json( subfield_value_u ) | html %]"; > } > if(code.value == 'v'){ >- subfield.value = "[% subfield_value_v |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"; >+ subfield.value = "[% To.json( subfield_value_v ) | html %]"; > } > if(code.value == 'x'){ >- subfield.value = "[% subfield_value_x |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"; >+ subfield.value = "[% To.json( subfield_value_x ) | html %]"; > } > if(code.value == 'y'){ >- subfield.value = "[% subfield_value_y |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"; >+ subfield.value = "[% To.json( subfield_value_y ) | html %]"; > } > } > } >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 26102
:
107579
|
108083
|
108084
|
108085
|
108086
|
108087
|
108088
|
108089
|
108090
|
119643
|
119644
|
119645
|
119646
|
119647
|
119648
|
119649
|
127669
|
127670
|
127671
|
127672
|
127673
|
127674
|
127675
|
128716
|
128717
|
128718
|
128719
|
128720
|
128721
|
128722
|
130931
|
130932
|
130933
|
130934
|
130935
|
130936
|
130999
|
131000
|
131001
|
131002
|
131003
| 131004