From a05c9fa1501f0ac6d9f45ee59b69c5d0e2c562af Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 2 Aug 2016 14:06:41 +0100 Subject: [PATCH] Bug 17023: Fix XSS in cataloguing/z3950_search.pl MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Test plan: Enter the following in the different inputs: => Without this patch you will see the alert => With this patch, no more alert Signed-off-by: Chris Cormack Signed-off-by: Katrin Fischer Signed-off-by: Brendan Gallagher (cherry picked from commit f6e0a619d974fe002ec6a920206c7bc2808bce26) Signed-off-by: Frédéric Demians (cherry picked from commit 98c6d7873535d52609657ecaf256740c95c0e532) Signed-off-by: Julian Maurice --- .../prog/en/modules/cataloguing/z3950_search.tt | 54 +++++++++++----------- 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt index 4272f84..887abd2 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt @@ -112,10 +112,10 @@ tr.selected { background-color : #FFFFCC; } tr.selected td { background-color :
    -
  1. -
  2. +
  3. +
  4. -
  5. +
  6. @@ -124,8 +124,8 @@ tr.selected { background-color : #FFFFCC; } tr.selected td { background-color :

Clear search form

- - + +

Search targets Select allClear all

@@ -150,16 +150,16 @@ tr.selected { background-color : #FFFFCC; } tr.selected td { background-color : [% ELSE %]

Results

You searched for: - [% IF ( title ) %]Title: [% title %] [% END %] - [% IF ( author ) %]Author: [% author %] [% END %] - [% IF ( isbn ) %]ISBN: [% isbn %] [% END %] - [% IF ( issn ) %]ISSN: [% issn %] [% END %] - [% IF ( lccall ) %]LC call number: [% lccall %] [% END %] - [% IF ( subject ) %]Subject heading: [% subject %] [% END %] - [% IF ( controlnumber ) %]Control no: [% controlnumber %] [% END %] - [% IF ( dewey ) %]Dewey: [% dewey %] [%END %] - [% IF ( srchany ) %]Raw (any): [% srchany %] [% END %] - [% IF ( stdid ) %]Standard ID: [% stdid %] [% END %] + [% IF ( title ) %]Title: [% title | html %] [% END %] + [% IF ( author ) %]Author: [% author | html %] [% END %] + [% IF ( isbn ) %]ISBN: [% isbn | html %] [% END %] + [% IF ( issn ) %]ISSN: [% issn | html %] [% END %] + [% IF ( lccall ) %]LC call number: [% lccall | html %] [% END %] + [% IF ( subject ) %]Subject heading: [% subject | html %] [% END %] + [% IF ( controlnumber ) %]Control no: [% controlnumber | html %] [% END %] + [% IF ( dewey ) %]Dewey: [% dewey | html %] [%END %] + [% IF ( srchany ) %]Raw (any): [% srchany | html %] [% END %] + [% IF ( stdid ) %]Standard ID: [% stdid | html %] [% END %]

[% IF ( errconn ) %]
@@ -211,17 +211,17 @@ tr.selected { background-color : #FFFFCC; } tr.selected td { background-color :
- - - - - - - - - - - + + + + + + + + + + + [% FOREACH server IN servers %] @@ -240,7 +240,7 @@ tr.selected { background-color : #FFFFCC; } tr.selected td { background-color : [% ELSE %]
Nothing found.
[% END %] -

+

[% END %] -- 2.1.4