From 45ffea907944b4a2992b1f9a9265a972543a58f5 Mon Sep 17 00:00:00 2001 From: Katrin Fischer <Katrin.Fischer.83@web.de> Date: Mon, 15 Oct 2012 09:07:50 +0200 Subject: [PATCH] Bug 3652: [SIGNED-OFF] XSS fixes - follow up Fixes a typo in the html filter that causes a problem when using the paging in the OPAC result lists. (forgot to commit my change when testing the original XSS patches) Signed-off-by: Magnus Enger <magnus@enger.priv.no> I triggered the error with this query string: /cgi-bin/koha/opac-search.pl?idx=kw&q=o'reilly&offset=40&sort_by=author_az After applying the patch the error is gone. --- .../opac-tmpl/prog/en/includes/page-numbers.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/opac-tmpl/prog/en/includes/page-numbers.inc b/koha-tmpl/opac-tmpl/prog/en/includes/page-numbers.inc index ff9b11c..935d943 100644 --- a/koha-tmpl/opac-tmpl/prog/en/includes/page-numbers.inc +++ b/koha-tmpl/opac-tmpl/prog/en/includes/page-numbers.inc @@ -1,6 +1,6 @@ [% IF ( PAGE_NUMBERS ) %]<div class="pages"> <!-- Row of numbers corresponding to search result pages --> - [% IF ( previous_page_offset ) %]<a class="nav" href="/cgi-bin/koha/opac-search.pl?[% query_cgi |html %][% limit_cgi |html %]&offset=[% previous_page_offset %][% IF ( sort_by ) %]&sort_by=[% sort_by |htm l%][% END %]"><< Previous</a>[% END %] + [% IF ( previous_page_offset ) %]<a class="nav" href="/cgi-bin/koha/opac-search.pl?[% query_cgi |html %][% limit_cgi |html %]&offset=[% previous_page_offset %][% IF ( sort_by ) %]&sort_by=[% sort_by |html %][% END %]"><< Previous</a>[% END %] [% FOREACH PAGE_NUMBER IN PAGE_NUMBERS %][% IF ( PAGE_NUMBER.highlight ) %]<span class="current">[% PAGE_NUMBER.pg %]</span>[% ELSE %] <a class="nav" href="/cgi-bin/koha/opac-search.pl?[% query_cgi |html %][% limit_cgi |html %]&offset=[% PAGE_NUMBER.offset %][% IF ( sort_by ) %]&sort_by=[% sort_by |html%][% END %]">[% PAGE_NUMBER.pg %]</a>[% END %] [% END %] [% IF ( next_page_offset ) %]<a class="nav" href="/cgi-bin/koha/opac-search.pl?[% query_cgi |html %][% limit_cgi |html %]&offset=[% next_page_offset %][% IF ( sort_by ) %]&sort_by=[% sort_by |html %][% END %]">Next >></a>[% END %] </div>[% END %] -- 1.7.9.5