Bugzilla – Attachment 51825 Details for
Bug 16599
XSS found in opac-shareshelf.pl
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 16599: Fix other potentials XSS for shelfname
Bug-16599-Fix-other-potentials-XSS-for-shelfname.patch (text/plain), 5.03 KB, created by
Jonathan Druart
on 2016-05-26 11:10:36 UTC
(
hide
)
Description:
Bug 16599: Fix other potentials XSS for shelfname
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2016-05-26 11:10:36 UTC
Size:
5.03 KB
patch
obsolete
>From c9724e400012b032d6534d3fbbcc93e50707688d Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Thu, 26 May 2016 12:08:30 +0100 >Subject: [PATCH] Bug 16599: Fix other potentials XSS for shelfname > >--- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt | 6 +++--- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-results-grouped.tt | 2 +- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves-rss.tt | 2 +- > 3 files changed, 5 insertions(+), 5 deletions(-) > >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt >index 4e4f832..7824f31 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt >@@ -1,7 +1,7 @@ > [% USE Koha %] > [% IF ( fullpage ) %] > [% INCLUDE 'doc-head-open.inc' %] >- <title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog › Download list [% shelf.shelfname %]</title>[% INCLUDE 'doc-head-close.inc' %] >+ <title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog › Download list [% shelf.shelfname | html %]</title>[% INCLUDE 'doc-head-close.inc' %] > [% BLOCK cssinclude %][% END %] > </head> > [% INCLUDE 'bodytag.inc' bodyid='opac-downloadlist' %] >@@ -20,7 +20,7 @@ > [% END %] > <span class="divider">›</span> > </li> >- <li>Download list <i>[% shelf.shelfname %]</i></li> >+ <li>Download list <i>[% shelf.shelfname | html %]</i></li> > </ul> > <div class="container-fluid"> > <div class="row-fluid"> >@@ -47,7 +47,7 @@ > <p>Your download should begin automatically.</p> > </div> > [% ELSE %] >- <h1>Download list <i>[% shelf.shelfname %]</i></h1> >+ <h1>Download list <i>[% shelf.shelfname | html %]</i></h1> > <form method="post" action="/cgi-bin/koha/opac-downloadshelf.pl"> > <fieldset> > <select name="format" id="dlformat" required="required"> >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-results-grouped.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-results-grouped.tt >index b36dacb..8595f9a 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-results-grouped.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-results-grouped.tt >@@ -288,7 +288,7 @@ $(document).ready(function(){ > }); > $("span.clearall").html("<a id=\"CheckNone\" href=\"#\">Clear all</a>"); > $("span.checkall").html("<a id=\"CheckAll\" href=\"#\">Select all</a>"); >- $("span.addto").html("<label for=\"addto\">Add to: </label><select name=\"addto\" id=\"addto\"><option value=\"\"></option>[% IF Koha.Preference( 'opacbookbag' ) == 1 %]<option value=\"addtocart\">Cart</option>[% END %][% IF Koha.Preference( 'virtualshelves' ) == 1 %][% IF ( loggedinusername ) %]<optgroup label=\"Lists:\">[% IF ( barshelves ) %][% FOREACH barshelvesloo IN barshelvesloop %][% IF ( category == 1 ) %]<option id=\"s[% barshelvesloo.shelfnumber %]\" value=\"addtolist\">[% barshelvesloo.shelfname %]</option>[% END %][% END %][% END %]<option value=\"newlist\">[ New list ]</option></optgroup>[% ELSE %]<option value=\"newlist\">List</option>[% END %][% END %]</select> <input type=\"submit\" class=\"submit\" value=\"Save\" />"); >+ $("span.addto").html("<label for=\"addto\">Add to: </label><select name=\"addto\" id=\"addto\"><option value=\"\"></option>[% IF Koha.Preference( 'opacbookbag' ) == 1 %]<option value=\"addtocart\">Cart</option>[% END %][% IF Koha.Preference( 'virtualshelves' ) == 1 %][% IF ( loggedinusername ) %]<optgroup label=\"Lists:\">[% IF ( barshelves ) %][% FOREACH barshelvesloo IN barshelvesloop %][% IF ( category == 1 ) %]<option id=\"s[% barshelvesloo.shelfnumber %]\" value=\"addtolist\">[% barshelvesloo.shelfname | html %]</option>[% END %][% END %][% END %]<option value=\"newlist\">[ New list ]</option></optgroup>[% ELSE %]<option value=\"newlist\">List</option>[% END %][% END %]</select> <input type=\"submit\" class=\"submit\" value=\"Save\" />"); > $("#addto").change(function(){ > cartList(); > }); >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves-rss.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves-rss.tt >index 2525d80..5e01834 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves-rss.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves-rss.tt >@@ -3,7 +3,7 @@ > <rss version="2.0"> > > <channel> >- <title>[% shelf.shelfname %]</title> >+ <title>[% shelf.shelfname | html %]</title> > <link>[% OPACBaseURL %]/cgi-bin/koha/opac-shelves.pl?rss=1&viewshelf=[% shelf.shelfnumber %]</link> > <description>RSS feed for public list [% shelf.shelfname | html %]</description> > >-- >2.8.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 16599
:
51822
|
51824
|
51825
|
51827
|
51828
|
51865
|
51866