Attachment 79611 Details for Bug 21418 – Bug 21418: Html escape the 2 variables

[patch] Bug 21418: Html escape the 2 variables

Bug-21418-Html-escape-the-2-variables.patch (text/plain), 1.44 KB, created by Jonathan Druart on 2018-09-29 14:27:55 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2018-09-29 14:27:55 UTC

Size: 1.44 KB

patch

obsolete

>From b0188dcbc52cd52cd187e5c4d2ad4f54e60f746b Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Sat, 29 Sep 2018 11:24:19 -0300
>Subject: [PATCH] Bug 21418: Html escape the 2 variables
>
>We should be on the safe side without this patch because shelfnumber and
>type comes from the DB and are integer or varchar. It may be better to
>show good examples to start, and escape everything anyway.
>
>Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>---
> .../prog/en/modules/virtualshelves/tables/shelves_results.tt            | 2 ++
> 1 file changed, 2 insertions(+)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt
>index fde5544390..db4ed8e7f9 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt
>@@ -34,6 +34,8 @@
> [% BLOCK action_form -%]
> [%~ SET action_block = '' ~%]
> [%~ IF can_manage_shelf OR can_delete_shelf ~%]
>+    [%~ shelfnumber = shelfnumber | html ~%]
>+    [%~ type        = type | html ~%]
>     [%~ IF can_manage_shelf ~%]
>         [%~ action_block =                '<form action="shelves.pl" method="get">' ~%]
>         [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber  _ '" />' ~%]
>-- 
>2.11.0

Actions: View | Diff | Splinter Review

Attachments on bug 21418: 79442 | 79610 | 79611 | 79612 | 79706 | 79707 | 79830 | 79831 | 79832