Bugzilla – Attachment 54111 Details for
Bug 17038
search.pl is vulnerable to XSS attacks
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[PASSED QA] Bug 17038: Fix XSS in catalogue/search.pl
PASSED-QA-Bug-17038-Fix-XSS-in-cataloguesearchpl.patch (text/plain), 1.52 KB, created by
Katrin Fischer
on 2016-08-07 09:59:49 UTC
(
hide
)
Description:
[PASSED QA] Bug 17038: Fix XSS in catalogue/search.pl
Filename:
MIME Type:
Creator:
Katrin Fischer
Created:
2016-08-07 09:59:49 UTC
Size:
1.52 KB
patch
obsolete
>From 22ce9d163d583096cb4b3f55974d3efe57361b93 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Wed, 3 Aug 2016 13:57:43 +0100 >Subject: [PATCH] [PASSED QA] Bug 17038: Fix XSS in catalogue/search.pl > >Test plan: >Search for something like: > \";alert(1)//135 > >=> Without this patch you will see the alert >=> With this patch, no more alert > >Note that this fix the parameters idx, q and op > >Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> > >Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> >--- > koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt >index 9902578..05c4d19 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt >@@ -152,7 +152,7 @@ $('#sort_by').change(function() { > $(".selection").show(); > [% IF ( query_desc ) %] > toHighlight = $("p,span.results_summary,a.title"); >- var query_desc = "[% query_desc |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]"; >+ var query_desc = "[% query_desc |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"; > q_array = query_desc.split(" "); > // ensure that we don't have "" at the end of the array, which can > // break the highlighter >-- >1.9.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 17038
:
53944
|
53985
| 54111