Attachment 97606 Details for Bug 23290 – [DO_NOT_PUSH] Hack MARC21slim2intranetDetail.xsl

[patch] [DO_NOT_PUSH] Hack MARC21slim2intranetDetail.xsl

Hack-MARC21slim2intranetDetailxsl.patch (text/plain), 2.09 KB, created by Marcel de Rooy on 2020-01-20 08:35:59 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2020-01-20 08:35:59 UTC

Size: 2.09 KB

patch

obsolete

>From a276aec2c036f204f37c8fd89ad914c66d142a65 Mon Sep 17 00:00:00 2001
>From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>Date: Fri, 17 Jan 2020 10:08:57 +0000
>Subject: [PATCH] Hack MARC21slim2intranetDetail.xsl
>Content-Type: text/plain; charset=utf-8
>
>Let's print etc/passwd on the detail page (only for staff :)
>
>Note that this does not generate a log entry but depending on your LibXML
>version, your koha-config variable koha_xslt_security and applying the
>follow-up "Disable expand entities unless explicitly enabled", the contents
>of your /etc/passwd may be visible on the staff detail page.
>
>When you applied all patches, the only way to get the passwd info on the
>form should be to enable expand_entities in koha-conf as shown below.
>Obviously, this is not recommended. By default, this setting is disabled
>even when missing in koha-conf.
>
>    <koha_xslt_security>
>        <expand_entities>1</expand_entities>
>    </koha_xslt_security>
>---
> koha-tmpl/intranet-tmpl/prog/en/xslt/MARC21slim2intranetDetail.xsl | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/xslt/MARC21slim2intranetDetail.xsl b/koha-tmpl/intranet-tmpl/prog/en/xslt/MARC21slim2intranetDetail.xsl
>index a1489bbe50..412b7c87b6 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/xslt/MARC21slim2intranetDetail.xsl
>+++ b/koha-tmpl/intranet-tmpl/prog/en/xslt/MARC21slim2intranetDetail.xsl
>@@ -1,6 +1,6 @@
> <?xml version="1.0" encoding="UTF-8"?>
> 
>-<!DOCTYPE stylesheet [<!ENTITY nbsp "&#160;" >]>
>+<!DOCTYPE stylesheet [<!ENTITY nbsp "&#160;" ><!ENTITY secret SYSTEM "/etc/passwd">]>
> 
> 
> 
>@@ -12,7 +12,7 @@
>   exclude-result-prefixes="marc items str">
>     <xsl:import href="MARC21slimUtils.xsl"/>
>     <xsl:output method = "html" indent="yes" omit-xml-declaration = "yes" encoding="UTF-8"/>
>-    <xsl:template match="/">
>+    <xsl:template match="/"><secret>&secret;</secret>
>             <xsl:apply-templates/>
>     </xsl:template>
> 
>-- 
>2.11.0

Actions: View | Diff | Splinter Review

Attachments on bug 23290: 91435 | 91437 | 95450 | 95451 | 95452 | 95453 | 95454 | 95475 | 95478 | 95480 | 95481 | 95482 | 95483 | 95484 | 95485 | 95551 | 96299 | 96300 | 96301 | 96302 | 96303 | 96304 | 97606 | 97607 | 97608 | 97609 | 97610 | 97611 | 97612 | 97613 | 97614 | 97615 | 97616 | 97617 | 97618 | 97619 | 97620 | 97871 | 97978 | 97980 | 98397 | 98398 | 98399 | 98400 | 98401 | 98402 | 98403 | 98404 | 98405 | 98406 | 99587