From 62b2e04294b6e9096c4efe4ae70fe8b470520d53 Mon Sep 17 00:00:00 2001 From: Chris Cormack Date: Wed, 10 Dec 2014 12:47:30 +1300 Subject: [PATCH] Bug 13425 - XSS in opac facets - Patch for 3.16 To Test 1/ Craft a url like /cgi-bin/koha/opac-search.pl?q=123&sort_by='">&limit=123 It is important it must return results and facets 2/ Notice the js is executed 3/ Apply the patch test again Test this one both in prog and bootstrap please --- koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-facets.inc | 4 ++-- koha-tmpl/opac-tmpl/prog/en/includes/opac-facets.inc | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-facets.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-facets.inc index 7044bfd..e1b69a5 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-facets.inc +++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-facets.inc @@ -42,10 +42,10 @@ [% IF facet.active %] [% SET url = url _ "&nolimit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %] [% facet.facet_label_value %] - [x] + [x] [% ELSE %] [% SET url = url _ "&limit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %] - [% facet.facet_label_value %] + [% facet.facet_label_value %] [% IF ( displayFacetCount ) %] ([% facet.facet_count %]) [% END %] diff --git a/koha-tmpl/opac-tmpl/prog/en/includes/opac-facets.inc b/koha-tmpl/opac-tmpl/prog/en/includes/opac-facets.inc index 8354ec1..e8c0a38 100644 --- a/koha-tmpl/opac-tmpl/prog/en/includes/opac-facets.inc +++ b/koha-tmpl/opac-tmpl/prog/en/includes/opac-facets.inc @@ -37,7 +37,7 @@ [x] [% ELSE %] [% SET url = url _ "&limit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %] - [% facet.facet_label_value %] + [% facet.facet_label_value %] [% IF ( displayFacetCount ) %] ([% facet.facet_count %]) [% END %] -- 2.1.3