From afd70accb56061a74155d594b06099b92c06f8f6 Mon Sep 17 00:00:00 2001
From: Katrin Fischer <katrin.fischer@bsz-bw.de>
Date: Thu, 22 Jan 2015 14:41:09 +0100
Subject: [PATCH] [SIGNED OFF] Bug 13609: Cross Site Scripting problem in
authority search result list paging
To test:
- Use an installation a reasonable amount of authorities, so that you can
have a search result list with more than one page
- Activate OpacAuthorities
- Create an OPAC link like shown below, verify that an alert is shown
- Apply patch
- Refresh the page and no alert should appear
- Verify the paging still works correctly for 'numbers' and 'arrows'
URL:
.../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
---
.../bootstrap/en/modules/opac-authoritiessearchresultlist.tt | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt
index eaef8b6..00d657e 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt
@@ -6,7 +6,7 @@
<ul>
[% IF ( displayprev ) %]
<li>
- <a href="opac-authorities-home.pl?startfrom=[% startfromprev %]&[% FOREACH searchdat IN searchdata %][% searchdat.term %]=[% searchdat.val |url %]&[% END %]resultsperpage=[% resultsperpage %]&type=opac&op=do_search&authtypecode=[% authtypecode %]&orderby=[% orderby %]">
+ <a href="opac-authorities-home.pl?startfrom=[% startfromprev %]&[% FOREACH searchdat IN searchdata %][% searchdat.term %]=[% searchdat.val |url %]&[% END %]resultsperpage=[% resultsperpage %]&type=opac&op=do_search&authtypecode=[% authtypecode %]&orderby=[% orderby|html %]">
«
</a>
</li>
@@ -15,12 +15,12 @@
[% IF ( number.highlight ) %]
<li class="active"><a href="#">[% number.number %]</a></li>
[% ELSE %]
- <li><a href="opac-authorities-home.pl?startfrom=[% number.startfrom %]&[% FOREACH searchdat IN number.searchdata %][% searchdat.term %]=[% searchdat.val |url %]&[% END %]resultsperpage=[% resultsperpage %]&type=opac&op=do_search&authtypecode=[% authtypecode %]&orderby=[% orderby %]">[% number.number %]</a></li>
+ <li><a href="opac-authorities-home.pl?startfrom=[% number.startfrom %]&[% FOREACH searchdat IN number.searchdata %][% searchdat.term %]=[% searchdat.val |url %]&[% END %]resultsperpage=[% resultsperpage %]&type=opac&op=do_search&authtypecode=[% authtypecode %]&orderby=[% orderby|html %]">[% number.number %]</a></li>
[% END %]
[% END %]
[% IF ( displaynext ) %]
<li>
- <a href="opac-authorities-home.pl?startfrom=[% startfromnext %]&[% FOREACH searchdat IN searchdata %][% searchdat.term %]=[% searchdat.val |url %]&[% END %]&resultsperpage=[% resultsperpage %]&type=opac&op=do_search&authtypecode=[% authtypecode %]&orderby=[% orderby %]">»</a>
+ <a href="opac-authorities-home.pl?startfrom=[% startfromnext %]&[% FOREACH searchdat IN searchdata %][% searchdat.term %]=[% searchdat.val |url %]&[% END %]&resultsperpage=[% resultsperpage %]&type=opac&op=do_search&authtypecode=[% authtypecode %]&orderby=[% orderby|html %]">»</a>
</li>
[% END %]
</ul>
--
1.9.1