From d102bb78ffdfb4b17b7e152871d09cb4fdc4412a Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Thu, 30 Jul 2020 13:59:46 +0200 Subject: [PATCH] Bug 26102: Prevent XSS when To.json is used --- .../prog/en/includes/js_includes.inc | 2 +- .../prog/en/modules/admin/preferences.tt | 2 +- .../en/modules/authorities/authorities.tt | 2 +- .../authorities/blinddetail-biblio-search.tt | 4 +-- .../prog/en/modules/catalogue/itemsearch.tt | 2 +- .../prog/en/modules/catalogue/results.tt | 2 +- .../value_builder/unimarc_field_4XX.tt | 34 +++++++++---------- .../prog/en/modules/members/memberentrygen.tt | 2 +- .../members/tables/guarantor_search.tt | 2 +- .../prog/en/modules/reserve/request.tt | 4 +-- .../en/modules/serials/subscription-add.tt | 2 +- .../suggestion/tables/suggester_search.tt | 2 +- .../bootstrap/en/modules/sco/sco-main.tt | 2 +- 13 files changed, 31 insertions(+), 31 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc index f56faebea8..687e84a47b 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc @@ -66,7 +66,7 @@ [% Asset.js("js/subscription-add.js") | $raw %] [% Asset.js("js/showpredictionpattern.js") | $raw %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/tables/suggester_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/tables/suggester_search.tt index a82f0e8dcb..cbac0393a9 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/tables/suggester_search.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/tables/suggester_search.tt @@ -32,5 +32,5 @@ [%~ IF data.zipcode %][% SET address = address _ data.zipcode _ ' ' %][% END %] [%~ IF data.country %][% SET address = address _ data.country _ ' ' %][% END %] [%~ SET address = address _ Branches.GetName( data.branchcode ) %] -[%~ To.json( address ) | $raw ~%] +[%~ address | html | $To ~%] [% END %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt index c428886a4d..6d8622fd0c 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt @@ -440,7 +440,7 @@ return true; } [% IF Koha.Preference('AudioAlerts') %] - var AUDIO_ALERTS = JSON.parse( "[% To.json(AudioAlerts.AudioAlerts) | $raw %]" ); + var AUDIO_ALERTS = JSON.parse( "[% To.json(AudioAlerts.AudioAlerts) | html %]" ); $( document ).ready(function() { if ( AUDIO_ALERTS ) { for ( var k in AUDIO_ALERTS ) { -- 2.20.1