Attachment 35464 Details for Bug 13609 – Bug 13609: Cross Site Scripting problem in authority search result list paging

[patch] Bug 13609: Cross Site Scripting problem in authority search result list paging

Bug-13609-Cross-Site-Scripting-problem-in-authorit.patch (text/plain), 3.74 KB, created by Katrin Fischer on 2015-01-22 13:49:50 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Katrin Fischer

Created: 2015-01-22 13:49:50 UTC

Size: 3.74 KB

patch

obsolete

>From 54849d7f749f0183fff29db8c823d7493b0e6721 Mon Sep 17 00:00:00 2001
>From: Katrin Fischer <katrin.fischer@bsz-bw.de>
>Date: Thu, 22 Jan 2015 14:41:09 +0100
>Subject: [PATCH] Bug 13609: Cross Site Scripting problem in authority search
> result list paging
>
>To test:
>- Use an installation a reasonable amount of authorities, so that you can
>  have a search result list with more than one page
>- Activate OpacAuthorities
>- Create an OPAC link like shown below, verify that an alert is shown
>- Apply patch
>- Refresh the page and no alert should appear
>- Verify the paging still works correctly for 'numbers' and 'arrows'
>
>URL:
>.../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script>
>---
> .../bootstrap/en/modules/opac-authoritiessearchresultlist.tt     |    6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
>diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt
>index eaef8b6..00d657e 100644
>--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt
>+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt
>@@ -6,7 +6,7 @@
>         <ul>
>             [% IF ( displayprev ) %]
>                 <li>
>-                    <a href="opac-authorities-home.pl?startfrom=[% startfromprev %]&amp;[% FOREACH searchdat IN searchdata %][% searchdat.term %]=[% searchdat.val |url %]&amp;[% END %]resultsperpage=[% resultsperpage %]&amp;type=opac&amp;op=do_search&amp;authtypecode=[% authtypecode %]&amp;orderby=[% orderby %]">
>+                    <a href="opac-authorities-home.pl?startfrom=[% startfromprev %]&amp;[% FOREACH searchdat IN searchdata %][% searchdat.term %]=[% searchdat.val |url %]&amp;[% END %]resultsperpage=[% resultsperpage %]&amp;type=opac&amp;op=do_search&amp;authtypecode=[% authtypecode %]&amp;orderby=[% orderby|html %]">
>                         &laquo;
>                     </a>
>                 </li>
>@@ -15,12 +15,12 @@
>                 [% IF ( number.highlight ) %]
>                     <li class="active"><a href="#">[% number.number %]</a></li>
>                 [% ELSE %]
>-                    <li><a href="opac-authorities-home.pl?startfrom=[% number.startfrom %]&amp;[% FOREACH searchdat IN number.searchdata %][% searchdat.term %]=[% searchdat.val |url %]&amp;[% END %]resultsperpage=[% resultsperpage %]&amp;type=opac&amp;op=do_search&amp;authtypecode=[% authtypecode %]&amp;orderby=[% orderby %]">[% number.number %]</a></li>
>+                    <li><a href="opac-authorities-home.pl?startfrom=[% number.startfrom %]&amp;[% FOREACH searchdat IN number.searchdata %][% searchdat.term %]=[% searchdat.val |url %]&amp;[% END %]resultsperpage=[% resultsperpage %]&amp;type=opac&amp;op=do_search&amp;authtypecode=[% authtypecode %]&amp;orderby=[% orderby|html %]">[% number.number %]</a></li>
>                 [% END %]
>             [% END %]
>             [% IF ( displaynext ) %]
>                 <li>
>-                    <a href="opac-authorities-home.pl?startfrom=[% startfromnext %]&amp;[% FOREACH searchdat IN searchdata %][% searchdat.term %]=[% searchdat.val |url %]&amp;[% END %]&amp;resultsperpage=[% resultsperpage %]&amp;type=opac&amp;op=do_search&amp;authtypecode=[% authtypecode %]&amp;orderby=[% orderby %]">&raquo;</a>
>+                    <a href="opac-authorities-home.pl?startfrom=[% startfromnext %]&amp;[% FOREACH searchdat IN searchdata %][% searchdat.term %]=[% searchdat.val |url %]&amp;[% END %]&amp;resultsperpage=[% resultsperpage %]&amp;type=opac&amp;op=do_search&amp;authtypecode=[% authtypecode %]&amp;orderby=[% orderby|html %]">&raquo;</a>
>                 </li>
>             [% END %]
>         </ul>
>-- 
>1.7.10.4

Actions: View | Diff | Splinter Review

Attachments on bug 13609: 35464 | 35469 | 35474 | 35476 | 35477