From 81e5dbdbf771d8b697c369489ebc2494d264b51e Mon Sep 17 00:00:00 2001 From: Owen Leonard Date: Fri, 16 Jul 2010 08:35:40 -0400 Subject: [PATCH 2/2] Further fixes for Bug 3652 - XSS vulnerabilities Applying "ESCAPE='0'" where necessary in the staff client --- .../prog/en/includes/auth-finder-search.inc | 6 ++-- .../prog/en/includes/doc-head-close.inc | 2 +- .../prog/en/includes/doc-head-open.inc | 6 ++++- .../intranet-tmpl/prog/en/includes/header.inc | 2 +- .../prog/en/includes/intranet-bottom.inc | 10 ++++---- .../prog/en/modules/acqui/neworderbiblio.tmpl | 2 +- .../prog/en/modules/acqui/neworderempty.tmpl | 12 +++++----- .../prog/en/modules/acqui/newordersuggestion.tmpl | 2 +- .../prog/en/modules/acqui/z3950_search.tmpl | 4 +- .../prog/en/modules/admin/aqbudgetperiods.tmpl | 2 +- .../prog/en/modules/admin/aqbudgets.tmpl | 1 + .../prog/en/modules/admin/aqplan.tmpl | 8 +++--- .../en/modules/admin/auth_subfields_structure.tmpl | 18 ++++++++-------- .../prog/en/modules/admin/authorised_values.tmpl | 2 +- .../prog/en/modules/admin/classsources.tmpl | 5 +-- .../en/modules/admin/item_circulation_alerts.tmpl | 4 +- .../prog/en/modules/admin/koha2marclinks.tmpl | 22 ++++++++++---------- .../en/modules/admin/marc_subfields_structure.tmpl | 16 +++++++------- .../prog/en/modules/admin/matching-rules.tmpl | 2 +- .../prog/en/modules/admin/patron-attr-types.tmpl | 2 +- koha-tmpl/intranet-tmpl/prog/en/modules/auth.tmpl | 2 +- .../prog/en/modules/authorities/authorities.tmpl | 2 +- .../modules/authorities/searchresultlist-auth.tmpl | 2 +- .../en/modules/authorities/searchresultlist.tmpl | 2 +- .../prog/en/modules/basket/basket.tmpl | 6 ++-- .../prog/en/modules/basket/sendbasket.tmpl | 2 +- .../prog/en/modules/catalogue/ISBDdetail.tmpl | 2 +- .../prog/en/modules/catalogue/MARCdetail.tmpl | 2 +- .../prog/en/modules/catalogue/detail.tmpl | 20 +++++++++--------- .../en/modules/catalogue/labeledMARCdetail.tmpl | 2 +- .../prog/en/modules/cataloguing/addbiblio.tmpl | 2 +- .../prog/en/modules/cataloguing/additem.tmpl | 4 +- .../prog/en/modules/circ/circulation.tmpl | 10 ++++---- .../prog/en/modules/intranet-main.tmpl | 4 +- .../prog/en/modules/labels/label-edit-batch.tmpl | 2 +- .../prog/en/modules/labels/label-home.tmpl | 4 +- .../prog/en/modules/labels/spinelabel-print.tmpl | 2 +- .../prog/en/modules/members/member.tmpl | 2 +- .../prog/en/modules/members/memberentrygen.tmpl | 6 ++-- .../en/modules/reports/acquisitions_stats.tmpl | 14 ++++++------ .../prog/en/modules/reports/bor_issues_top.tmpl | 2 +- .../prog/en/modules/reports/borrowers_out.tmpl | 4 +- .../prog/en/modules/reports/borrowers_stats.tmpl | 4 +- .../prog/en/modules/reports/cat_issues_top.tmpl | 4 +- .../prog/en/modules/reports/catalogue_out.tmpl | 4 +- .../prog/en/modules/reports/catalogue_stats.tmpl | 4 +- .../prog/en/modules/reports/issues_avg_stats.tmpl | 16 +++++++------- .../reports/issues_by_borrower_category.tmpl | 2 +- .../prog/en/modules/reports/issues_stats.tmpl | 4 +- .../prog/en/modules/reports/itemtypes.tmpl | 2 +- .../prog/en/modules/reports/serials_stats.tmpl | 4 +- .../prog/en/modules/reserve/request.tmpl | 4 +- 52 files changed, 139 insertions(+), 135 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/auth-finder-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/auth-finder-search.inc index 437b313..fe4f612 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/auth-finder-search.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/auth-finder-search.inc @@ -17,7 +17,7 @@ - " /> + " />
  • @@ -29,7 +29,7 @@ - " /> + " />
  • @@ -41,7 +41,7 @@ - " /> + " />
  • diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc index bbbd648..c6479e1 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc @@ -75,7 +75,7 @@ diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-open.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-open.inc index df2dc01..d7b838d 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-open.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-open.inc @@ -1,4 +1,8 @@ -" xml:lang="" dir="" xmlns="http://www.w3.org/1999/xhtml"> + +" xml:lang="" dir="" xmlns="http://www.w3.org/1999/xhtml"> + +" xml:lang="" xmlns="http://www.w3.org/1999/xhtml"> + diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc index 95ce8dd..3e3ab36 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc @@ -9,7 +9,7 @@
  • Cart
  • - +
  • More
    diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/intranet-bottom.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/intranet-bottom.inc index 839c176..07697a7 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/intranet-bottom.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/intranet-bottom.inc @@ -7,14 +7,14 @@ -
  • " href="#"> ()
    "> +
  • " href="#"> ()
    ">
      -
    • ()
    • +
    • ()
    • -
    • "> ()
    • +
    • "> ()
    • @@ -24,9 +24,9 @@ -
    • +
    • -
    • ">
    • +
    • ">
    • diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderbiblio.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderbiblio.tmpl index f09f474..dbbf8f4 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderbiblio.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderbiblio.tmpl @@ -48,7 +48,7 @@ -

      +

      by ,

      - diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tmpl index 85ccb6f..f53e3ce 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tmpl @@ -153,10 +153,10 @@ ff.submit();

      1. Title - " /> + " /> - " /> + " />
      2. @@ -219,8 +219,8 @@ ff.submit();
        1. "> - - + + " /> " /> @@ -353,7 +353,7 @@ ff.submit(); - + " /> @@ -363,7 +363,7 @@ ff.submit(); - + " /> diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tmpl index 630d9ba..e9c0495 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tmpl @@ -27,7 +27,7 @@ -

          -

          +

          -

          copy. year: volume: diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tmpl index 063520c..8aa0615 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tmpl @@ -73,7 +73,7 @@ tr.selected { background-color : #FFFFCC; } tr.selected td { background-color :

          -
          1. " />
          2. +
            1. " />
            2. " />
            3. @@ -143,7 +143,7 @@ tr.selected { background-color : #FFFFCC; } tr.selected td { background-color : - + diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgetperiods.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgetperiods.tmpl index 523fd13..8f1f06b 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgetperiods.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgetperiods.tmpl @@ -294,7 +294,7 @@ -
              +
          diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tmpl index 80d9156..925cb7e 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tmpl @@ -241,6 +241,7 @@ +

          Currency =

          diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqplan.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqplan.tmpl index 2192178..fc39f8a 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqplan.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqplan.tmpl @@ -104,7 +104,7 @@ YAHOO.util.Event.onAvailable("popmenu", function () { - + @@ -176,7 +176,7 @@ YAHOO.util.Event.onAvailable("popmenu", function () { - +   @@ -279,8 +279,8 @@ YAHOO.util.Event.onAvailable("popmenu", function () {
          1. -     + +     " /> diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tmpl index 1b431ec..64d2a29 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tmpl @@ -75,34 +75,34 @@ function displayMoreConstraint(numlayer){
              -
            1.  
            2. +
            3.  
            4. " />
            5. -
            6.  
            7. -
            8.  
            9. +
            10.  
            11. +
            12.  
            13. " type="text" name="liblibrarian" value="" size="40" maxlength="80" />
            14. " name="libopac" value="" size="40" maxlength="80" />
            15. -
            16. (ignore means that the subfield does not display in the record editor)
            17. +
            18. (ignore means that the subfield does not display in the record editor)
            19. Display
                -
              1. +
              2. ">Intranet: --> ">Editor: (see online help) -->
            20. -
            21. (if checked, it means that the subfield is a URL and can be clicked)
            22. +
            23. (if checked, it means that the subfield is a URL and can be clicked)
            24. Help input
                -
              1. -
              2. -
              3. +
              4. +
              5. +
            25. diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tmpl index bef0cae..7264db1 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tmpl @@ -174,7 +174,7 @@
          -
          +

          An authorized value attached to patrons, that can be used for stats purposes

          diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/classsources.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/classsources.tmpl index 569d875..a5f81b5 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/classsources.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/classsources.tmpl @@ -274,9 +274,8 @@ $(document).ready(function() { -
          +
          -

          Classification Filing Rules

          Added filing rule
          @@ -310,7 +309,7 @@ $(document).ready(function() { -
          +
          diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/item_circulation_alerts.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/item_circulation_alerts.tmpl index 48dd3ad..d2ffbaf 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/item_circulation_alerts.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/item_circulation_alerts.tmpl @@ -157,7 +157,7 @@ $(function(){   - + @@ -181,7 +181,7 @@ $(function(){   - + diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/koha2marclinks.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/koha2marclinks.tmpl index b8f664a..c1e3103 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/koha2marclinks.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/koha2marclinks.tmpl @@ -33,7 +33,7 @@ " /> " /> - +
        2. @@ -42,7 +42,7 @@ " /> - + " />
        3. @@ -53,7 +53,7 @@ " /> " /> - +
        4. @@ -63,7 +63,7 @@ " /> " /> - +
        5. @@ -73,7 +73,7 @@ " /> " /> - +
        6. @@ -83,7 +83,7 @@ " /> " /> - +
        7. @@ -93,7 +93,7 @@ " /> " /> - +
        8. @@ -103,7 +103,7 @@ " /> " /> - +
        9. @@ -113,7 +113,7 @@ " /> " /> - +
        10. @@ -123,7 +123,7 @@ " /> " /> - +
        @@ -144,7 +144,7 @@

        Koha to MARC Mapping

        " method="post"> -

        +

        diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tmpl index 7873296..b432d72 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tmpl @@ -98,9 +98,9 @@
      3. " type="text" name="liblibrarian" value="" size="40" maxlength="80" />
      4. " name="libopac" value="" size="40" maxlength="80" />
      5. -
      6. -
      7. -
      8. (ignore means that the subfield does not display in the record editor)
      9. +
      10. +
      11. +
      12. (ignore means that the subfield does not display in the record editor)
      13. @@ -111,17 +111,17 @@
        1. " value="" />
        2. " name="hidden" value="" size="2" /> (see online help)
        3. -
        4. (if checked, it means that the subfield is a URL and can be clicked)
        5. +
        6. (if checked, it means that the subfield is a URL and can be clicked)
        7. " name="link" value="" size="10" maxlength="80" /> (e.g., Title or Local-Number) Warning: This value should not change after data has been added to your catalog
        8. -
        9. +
        Other Options: (choose one)
          -
        1. -
        2. -
        3. +
        4. +
        5. +

        diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tmpl index bfa2ed9..df77592 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tmpl @@ -572,7 +572,7 @@ function CheckRuleForm(f) {

        There are no saved matching rules.

        -
        +
        diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tmpl index b445c41..8e1c7ea 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tmpl @@ -221,7 +221,7 @@ function CheckAttributeTypeForm(f) {

        There are no saved patron attribute types.

        -
        +
        diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tmpl index fe2cd96..5d8b767 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tmpl @@ -39,7 +39,7 @@
        " method="post" name="loginform" id="loginform"> - " value="" /> + " value="" />

        " size="20" tabindex="1" /> diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tmpl index cadea08..877de7b 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tmpl @@ -705,7 +705,7 @@ function searchauthority() { - + Clone diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist-auth.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist-auth.tmpl index e327451..80c7657 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist-auth.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist-auth.tmpl @@ -93,7 +93,7 @@ function jumpfull(page) - &authtypecode=&=&op=do_search&type=intranet&index=&tagid=&orderby="> + &authtypecode=&=&op=do_search&type=intranet&index=&tagid=&orderby="> >>

    diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist.tmpl index 01667e5..6c7ccf6 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist.tmpl @@ -79,7 +79,7 @@ function searchauthority() {
    -
    +
    No results found diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/basket.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/basket.tmpl index d3d83ac..4057166 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/basket.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/basket.tmpl @@ -133,12 +133,12 @@ function placeHold () {

    - + " name="bib" id="bib" onclick="selRecord(value,checked)" /> - + @@ -318,7 +318,7 @@ function placeHold () { ',)"> - +

    - diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasket.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasket.tmpl index e5cc60d..f4bcde0 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasket.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasket.tmpl @@ -15,7 +15,7 @@ Reference Manager or ProCite. --------------------------------------------- - + Author(s): ; ; diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/ISBDdetail.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/ISBDdetail.tmpl index 1516268..1fc87dc 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/ISBDdetail.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/ISBDdetail.tmpl @@ -17,7 +17,7 @@

    - +
    diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/MARCdetail.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/MARCdetail.tmpl index 8880f8b..736e09e 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/MARCdetail.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/MARCdetail.tmpl @@ -391,7 +391,7 @@ function Changefwk(FwkList) { - + diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tmpl index 273150a..424fbf5 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tmpl @@ -1,5 +1,5 @@ -Koha › Catalog › Details for <!-- TMPL_VAR NAME="title" escape="html" --> <!-- TMPL_LOOP NAME="subtitle" --> <!-- TMPL_VAR NAME="subfield" --><!-- /TMPL_LOOP --> +Koha › Catalog › Details for <!-- TMPL_VAR NAME="title" --> <!-- TMPL_LOOP NAME="subtitle" --> <!-- TMPL_VAR NAME="subfield" --><!-- /TMPL_LOOP -->