From 3634b82a9f9b3959147c30b3a3bb9d9246f6a571 Mon Sep 17 00:00:00 2001 From: Chris Cormack Date: Wed, 10 Dec 2014 12:47:30 +1300 Subject: [PATCH] Bug 13425 - XSS in intranet facets - Patch for 3.18 and master To Test 1/ Craft a url like /cgi-bin/koha/catalogue/search.pl?q=smith&sort_by='"> It is important it must return results and facets 2/ Notice the js is executed 3/ Apply the patch test again Signed-off-by: Katrin Fischer No prompts, no functional regressions found. Checked selecting and undoing facets, show more links and paging. --- koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc | 8 ++++---- koha-tmpl/intranet-tmpl/prog/en/includes/page-numbers.inc | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc index 97891eb..6a6ba05 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc @@ -3,7 +3,7 @@

Refine your search

    -
  • Availability +
  • Availability [% IF ( related ) %]
  • (related searches: [% FOREACH relate IN related %][% relate.related_search %][% END %])
  • [% END %] @@ -33,10 +33,10 @@ [% IF facet.active %] [% SET url = url _ "&nolimit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %] [% facet.facet_label_value %] - [x] + [x] [% ELSE %] [% SET url = url _ "&limit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %] - [% facet.facet_label_value %] + [% facet.facet_label_value %] [% IF ( displayFacetCount ) %] ([% facet.facet_count %]) [% END %] @@ -44,7 +44,7 @@ [% END %] [% IF ( facets_loo.expandable ) %] -
  • Show more
  • +
  • Show more
  • [% END %]
[% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/page-numbers.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/page-numbers.inc index a0f6abb..2992164 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/page-numbers.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/page-numbers.inc @@ -1,7 +1,7 @@ [% IF ( PAGE_NUMBERS ) %]
- [% IF ( previous_page_offset.defined ) %]<< Previous[% END %] - [% FOREACH PAGE_NUMBER IN PAGE_NUMBERS %][% IF ( PAGE_NUMBER.highlight ) %][% PAGE_NUMBER.pg %][% ELSE %] [% PAGE_NUMBER.pg %][% END %] + [% IF ( previous_page_offset.defined ) %]<< Previous[% END %] + [% FOREACH PAGE_NUMBER IN PAGE_NUMBERS %][% IF ( PAGE_NUMBER.highlight ) %][% PAGE_NUMBER.pg %][% ELSE %] [% PAGE_NUMBER.pg %][% END %] [% END %] - [% IF ( next_page_offset ) %]Next >>[% END %] + [% IF ( next_page_offset ) %]Next >>[% END %]
[% END %] -- 1.9.1