From 98db10b2bdd6a7c786a583d1403575fbb240f58d Mon Sep 17 00:00:00 2001 From: Chris Cormack Date: Wed, 10 Dec 2014 12:47:30 +1300 Subject: [PATCH] Bug 13425 - XSS in intranet facets - Patch for 3.16 To Test 1/ Craft a url like /cgi-bin/koha/catalogue/search.pl?q=smith&sort_by='"> It is important it must return results and facets 2/ Notice the js is executed 3/ Apply the patch test again Signed-off-by: Jared Camins-Esakov --- koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc index 97891eb..59a88c1 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc @@ -36,7 +36,7 @@ [x] [% ELSE %] [% SET url = url _ "&limit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %] - [% facet.facet_label_value %] + [% facet.facet_label_value %] [% IF ( displayFacetCount ) %] ([% facet.facet_count %]) [% END %] -- 1.9.1