From d55560d9d8eaff2d5339ffa9604d3dfb65f8496f Mon Sep 17 00:00:00 2001 From: Chris Hall Date: Wed, 17 Oct 2012 14:32:19 +1300 Subject: [PATCH] bug 3652 fixing XSS vulnerabilities in opac-search Content-Type: text/plain; charset="utf-8" http://koha-community.org Signed-off-by: Mason James --- koha-tmpl/opac-tmpl/prog/en/modules/opac-detail.tt | 2 +- .../prog/en/modules/opac-results-grouped.tt | 2 +- .../opac-tmpl/prog/en/modules/opac-results.tt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/opac-detail.tt b/koha-tmpl/opac-tmpl/prog/en/modules/opac-detail.tt index f740488..39a4e95 100644 --- a/koha-tmpl/opac-tmpl/prog/en/modules/opac-detail.tt +++ b/koha-tmpl/opac-tmpl/prog/en/modules/opac-detail.tt @@ -63,7 +63,7 @@ widgets : ['zebra'], sortList: [[0,0]] }); - [% IF ( query_desc ) %][% IF ( OpacHighlightedWords ) %]var query_desc = "[% query_desc |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]"; + [% IF ( query_desc ) %][% IF ( OpacHighlightedWords ) %]var query_desc = "[% query_desc |replace("'", "\'") |replace('\n', '\\n') |replace('\r', '\\r') |html %]"; q_array = query_desc.split(" "); highlightOn(); $("#highlight_toggle_on" ).hide().click(function() {highlightOn() ; return false;}); diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tt b/koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tt index 86e1a08..222d841 100644 --- a/koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tt +++ b/koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tt @@ -62,7 +62,7 @@ $(document).ready(function(){ return false; }); [% IF ( query_desc ) %] - var query_desc = "[% query_desc |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]"; + var query_desc = "[% query_desc |replace("'", "\'") |replace('\n', '\\n') |replace('\r', '\\r') |html %]"; q_array = query_desc.split(" "); // ensure that we don't have "" at the end of the array, which can // break the highlighter diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/opac-results.tt b/koha-tmpl/opac-tmpl/prog/en/modules/opac-results.tt index a3c09e2..95ed896 100644 --- a/koha-tmpl/opac-tmpl/prog/en/modules/opac-results.tt +++ b/koha-tmpl/opac-tmpl/prog/en/modules/opac-results.tt @@ -207,7 +207,7 @@ $(document).ready(function(){ [% END %] $("#holdDetails").hide(); -[% IF ( query_desc ) %][% IF ( OpacHighlightedWords ) %]var query_desc = "[% query_desc |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]"; +[% IF ( query_desc ) %][% IF ( OpacHighlightedWords ) %]var query_desc = "[% query_desc |replace("'", "\'") |replace('\n', '\\n') |replace('\r', '\\r') |html %]"; q_array = query_desc.split(" "); // ensure that we don't have "" at the end of the array, which can // break the highlighter -- 1.7.2.5