From b48298663b43eed0c4f54b9dacffe4fc0449572a Mon Sep 17 00:00:00 2001 From: Aleisha Date: Mon, 8 Jun 2015 02:30:23 +0000 Subject: [PATCH] [PASSED QA] Bug 14360: Unescaped variable causes alert Adding |html to [% resultsperpage %] to escape the variable and get rid of the alert. To test: 1) Go to URL such as ... /cgi-bin/koha/opac-authorities-home.pl?op=do_search&resultsperpage=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E 2) Notice pop-up box with alert 3) Apply patch, refresh page 4) Notice alert is gone Signed-off-by: Katrin Fischer Signed-off-by: Kyle M Hall --- .../en/modules/opac-authoritiessearchresultlist.tt | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt index 00d657e..d4a264b 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt @@ -6,7 +6,7 @@ -- 1.7.2.5