From add5dfb2492837503e6efc8cc84a7e1f02703487 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Wed, 3 Aug 2016 13:57:43 +0100 Subject: [PATCH] Bug 17038: Fix XSS in catalogue/search.pl Test plan: Search for something like: \";alert(1)//135 => Without this patch you will see the alert => With this patch, no more alert Note that this fix the parameters idx, q and op --- koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt index 9902578..05c4d19 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt @@ -152,7 +152,7 @@ $('#sort_by').change(function() { $(".selection").show(); [% IF ( query_desc ) %] toHighlight = $("p,span.results_summary,a.title"); - var query_desc = "[% query_desc |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]"; + var query_desc = "[% query_desc |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"; q_array = query_desc.split(" "); // ensure that we don't have "" at the end of the array, which can // break the highlighter -- 2.8.1