From cdb72f89f621d9d4ff3caed8f8c9372c54a43875 Mon Sep 17 00:00:00 2001
From: Dobrica Pavlinusic <dpavlin@rot13.org>
Date: Wed, 4 Mar 2015 11:38:42 +0100
Subject: [PATCH] Bug 13789 - facets with accented utf-8 characters generate double encoded links
Bug 13425 tried to fix XSS in OPAC, but as result it double encoded strings
in facets and made links with accented characters (which where encoded
by url filter) broken.
This is just a test commit to see wheater removing url filter fixes this
(it does), but it also re-introduces XSS bug so it's not ready for signoff.
---
.../bootstrap/en/includes/opac-facets.inc | 12 +++++-------
1 files changed, 5 insertions(+), 7 deletions(-)
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-facets.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-facets.inc
index 6e846f0..1b59774 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-facets.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-facets.inc
@@ -32,20 +32,18 @@
<ul>
[% FOREACH facet IN facets_loo.facets %]
<li>
- [% SET query_cgi_f = query_cgi %]
- [% SET limit_cgi_f = limit_cgi | url %]
- [% SET url = "/cgi-bin/koha/opac-search.pl?" _ query_cgi_f _ limit_cgi_f %]
+ [% SET url = "/cgi-bin/koha/opac-search.pl?" _ query_cgi _ limit_cgi %]
[% IF ( sort_by ) %]
- [% SET url = url _ "&sort_by=" _ sort_by |url %]
+ [% SET url = url _ "&sort_by=" _ sort_by %]
[% END %]
- [% facet.facet_link_value = BLOCK %][% facet.facet_link_value | uri %][% END %]
+ [% facet.facet_link_value = BLOCK %][% facet.facet_link_value %][% END %]
[% IF facet.active %]
[% SET url = url _ "&nolimit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %]
<span class="facet-label">[% facet.facet_label_value %]</span>
- [<a href="[% url |url%]" title="Remove facet [% facet.facet_link_value | html %]">x</a>]
+ [<a href="[% url %]" title="Remove facet [% facet.facet_link_value | html %]">x</a>]
[% ELSE %]
[% SET url = url _ "&limit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %]
- <span class="facet-label"><a href="[% url |url%]" title="[% facet.facet_title_value |html %]">[% facet.facet_label_value %]</a></span>
+ <span class="facet-label"><a href="[% url %]" title="[% facet.facet_title_value |html %]">[% facet.facet_label_value %]</a></span>
[% IF ( displayFacetCount ) %]
<span class="facet-count"> ([% facet.facet_count %])</span>
[% END %]
--
1.7.2.5