From 3caeaf95a587aaf5e8f124ad87730c31a12839ae Mon Sep 17 00:00:00 2001 From: Chris Cormack Date: Thu, 5 Dec 2013 10:09:20 +1300 Subject: [PATCH] Bug 11341 : XSS in opac-search.pl (facets) prog theme, bootstrap theme is safe To test 1/ Craft a url like cgi-bin/koha/opac-search.pl?idx=kw&q=fish&offset=20" onmouseover%3dprompt(994000) bad%3d" (the search must return enough results to have a show more link in the facets) 2/ Check the source, or mouseover the Show more links in the facets Notice the code is executable 3/ Apply patch - notice it is no longer executable Signed-off-by: Tomas Cohen Arazi Signed-off-by: Brendan Gallagher --- koha-tmpl/opac-tmpl/prog/en/includes/opac-facets.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/opac-tmpl/prog/en/includes/opac-facets.inc b/koha-tmpl/opac-tmpl/prog/en/includes/opac-facets.inc index 04a18c6..4141896 100644 --- a/koha-tmpl/opac-tmpl/prog/en/includes/opac-facets.inc +++ b/koha-tmpl/opac-tmpl/prog/en/includes/opac-facets.inc @@ -22,7 +22,7 @@ [% IF ( facets_loo.type_label_Location ) %]Locations[% END %] [% END %] -- 1.7.10.4