Attachment 90447 Details for Bug 23058 – Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search

[patch] Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search

Bug-23058-Prevent-XSS-vulnerabiliies-when-tag-is-p.patch (text/plain), 1013 bytes, created by Katrin Fischer on 2019-06-09 20:30:07 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Katrin Fischer

Created: 2019-06-09 20:30:07 UTC

Size: 1013 bytes

patch

obsolete

>From be784620f96d434747a63e61d3d0bdfae76986eb Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Wed, 5 Jun 2019 18:40:54 -0500
>Subject: [PATCH] Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to
> opac-search
>
>Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
>
>Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
>---
> opac/opac-search.pl | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/opac/opac-search.pl b/opac/opac-search.pl
>index 309776f9f6..437bb8bf6a 100755
>--- a/opac/opac-search.pl
>+++ b/opac/opac-search.pl
>@@ -604,7 +604,7 @@ my $results_hashref;
> my @coins;
> 
> if ($tag) {
>-    $query_cgi = "tag=" .$tag . "&" . $query_cgi;
>+    $query_cgi = "tag=" .  uri_escape_utf8( $tag ) . "&" . $query_cgi;
>     my $taglist = get_tags({term=>$tag, approved=>1});
>     $results_hashref->{biblioserver}->{hits} = scalar (@$taglist);
>     my @marclist = map { C4::Biblio::GetXmlBiblio( $_->{biblionumber} ) } @$taglist;
>-- 
>2.11.0

Actions: View | Diff | Splinter Review

Attachments on bug 23058: 90342 | 90358 | 90447