Bugzilla – Attachment 90358 Details for
Bug 23058
Cross-site scripting in OPAC search
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search
Bug-23058-Prevent-XSS-vulnerabiliies-when-tag-is-p.patch (text/plain), 955 bytes, created by
Nick Clemens (kidclamp)
on 2019-06-06 12:16:43 UTC
(
hide
)
Description:
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search
Filename:
MIME Type:
Creator:
Nick Clemens (kidclamp)
Created:
2019-06-06 12:16:43 UTC
Size:
955 bytes
patch
obsolete
>From 6e689179cfb992747a7afd5f59ca974b29063a4d Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Wed, 5 Jun 2019 18:40:54 -0500 >Subject: [PATCH] Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to > opac-search > >Signed-off-by: Nick Clemens <nick@bywatersolutions.com> >--- > opac/opac-search.pl | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/opac/opac-search.pl b/opac/opac-search.pl >index 309776f9f6..437bb8bf6a 100755 >--- a/opac/opac-search.pl >+++ b/opac/opac-search.pl >@@ -604,7 +604,7 @@ my $results_hashref; > my @coins; > > if ($tag) { >- $query_cgi = "tag=" .$tag . "&" . $query_cgi; >+ $query_cgi = "tag=" . uri_escape_utf8( $tag ) . "&" . $query_cgi; > my $taglist = get_tags({term=>$tag, approved=>1}); > $results_hashref->{biblioserver}->{hits} = scalar (@$taglist); > my @marclist = map { C4::Biblio::GetXmlBiblio( $_->{biblionumber} ) } @$taglist; >-- >2.11.0
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=90358">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 23058
:
90342
|
90358
|
90447