Bugzilla – Attachment 23242 Details for
Bug 11322
Suggestion "notes" field should be sanitized or escaped
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 11322 : XSS in suggestions - OPAC
Bug-11322--XSS-in-suggestions---OPAC.patch (text/plain), 6.05 KB, created by
Chris Cormack
on 2013-12-02 22:48:30 UTC
(
hide
)
Description:
Bug 11322 : XSS in suggestions - OPAC
Filename:
MIME Type:
Creator:
Chris Cormack
Created:
2013-12-02 22:48:30 UTC
Size:
6.05 KB
patch
obsolete
>From 3efe49079afcc6a56246d6520ad7f6e1ad9e2549 Mon Sep 17 00:00:00 2001 >From: Chris Cormack <chrisc@catalyst.net.nz> >Date: Tue, 3 Dec 2013 11:46:24 +1300 >Subject: [PATCH] Bug 11322 : XSS in suggestions - OPAC > >1/ Add a suggestion in the opac, with lots of html >2/ View that suggestion in the OPAC, note the html is rendering >3/ Apply the patch >4/ Test again, in prog and bootstrap, no more rendered html >--- > .../opac-tmpl/bootstrap/en/modules/opac-suggestions.tt | 12 ++++++------ > koha-tmpl/opac-tmpl/prog/en/modules/opac-suggestions.tt | 14 +++++++------- > 2 files changed, 13 insertions(+), 13 deletions(-) > >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt >index 0d87eff..bb7c1ea 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt >@@ -164,18 +164,18 @@ > [% END %] > <td> > <p><strong>[% suggestions_loo.title |html %]</strong></p> >- <p>[% IF ( suggestions_loo.author ) %][% suggestions_loo.author %],[% END %] >- [% IF ( suggestions_loo.copyrightdate ) %] - [% suggestions_loo.copyrightdate %],[% END %] >- [% IF ( suggestions_loo.publishercode ) %] - [% suggestions_loo.publishercode %][% END %] >- [% IF ( suggestions_loo.place ) %]([% suggestions_loo.place %])[% END %] >- [% IF ( suggestions_loo.collectiontitle ) %] , [% suggestions_loo.collectiontitle %][% END %] >+ <p>[% IF ( suggestions_loo.author ) %][% suggestions_loo.author |html %],[% END %] >+ [% IF ( suggestions_loo.copyrightdate ) %] - [% suggestions_loo.copyrightdate |html %],[% END %] >+ [% IF ( suggestions_loo.publishercode ) %] - [% suggestions_loo.publishercode |html %][% END %] >+ [% IF ( suggestions_loo.place ) %]([% suggestions_loo.place |html %])[% END %] >+ [% IF ( suggestions_loo.collectiontitle ) %] , [% suggestions_loo.collectiontitle |html %][% END %] > [% IF ( suggestions_loo.itemtype ) %] - [% suggestions_loo.itemtype %][% END %] > </p> > </td> > <td> > [% IF ( suggestions_loo.note ) %] > <span class="tdlabel">Note: </span> >- [% suggestions_loo.note %] >+ [% suggestions_loo.note |html %] > [% END %] > </td> > [% IF Koha.Preference( 'OPACViewOthersSuggestions' ) == 1 %] >diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/opac-suggestions.tt b/koha-tmpl/opac-tmpl/prog/en/modules/opac-suggestions.tt >index 0fcd5e2..ebc4847 100644 >--- a/koha-tmpl/opac-tmpl/prog/en/modules/opac-suggestions.tt >+++ b/koha-tmpl/opac-tmpl/prog/en/modules/opac-suggestions.tt >@@ -189,16 +189,16 @@ > </td>[% END %] > <td> > <p><strong>[% suggestions_loo.title |html %]</strong></p> >- <p>[% IF ( suggestions_loo.author ) %][% suggestions_loo.author %],[% END %] >- [% IF ( suggestions_loo.copyrightdate ) %] - [% suggestions_loo.copyrightdate %],[% END %] >- [% IF ( suggestions_loo.publishercode ) %] - [% suggestions_loo.publishercode %][% END %] >- [% IF ( suggestions_loo.place ) %]([% suggestions_loo.place %])[% END %] >- [% IF ( suggestions_loo.collectiontitle ) %] , [% suggestions_loo.collectiontitle %][% END %] >+ <p>[% IF ( suggestions_loo.author ) %][% suggestions_loo.author |html %],[% END %] >+ [% IF ( suggestions_loo.copyrightdate ) %] - [% suggestions_loo.copyrightdate |html %],[% END %] >+ [% IF ( suggestions_loo.publishercode ) %] - [% suggestions_loo.publishercode |html %][% END %] >+ [% IF ( suggestions_loo.place ) %]([% suggestions_loo.place |html %])[% END %] >+ [% IF ( suggestions_loo.collectiontitle ) %] , [% suggestions_loo.collectiontitle |html%][% END %] > [% IF ( suggestions_loo.itemtype ) %] - [% suggestions_loo.itemtype %][% END %] > </p> > </td> > <td> >- [% suggestions_loo.note %] >+ [% suggestions_loo.note |html %] > </td> > [% IF ( OPACViewOthersSuggestions ) %]<td> > [% IF ( suggestions_loo.branchcodesuggestedby ) %][% suggestions_loo.branchcodesuggestedby %][% ELSE %] [% END %] >@@ -215,7 +215,7 @@ > [% ELSIF ( suggestions_loo.AVAILABLE ) %]Available in the library > [% ELSE %] [% KohaAuthorisedValues.GetByCode( 'SUGGEST_STATUS', suggestions_loo.STATUS, 1 ) %] [% END %] > >- [% IF ( suggestions_loo.reason ) %]([% suggestions_loo.reason %])[% END %] >+ [% IF ( suggestions_loo.reason ) %]([% suggestions_loo.reason |html %])[% END %] > </td> > </tr> > [% END %] >-- >1.8.3.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 11322
:
23241
|
23242
|
23243
|
23244
|
23245
|
23246
|
23247
|
23248
|
23249