|
Description
Katrin Fischer
2015-01-22 12:18:41 UTC
Without the mouseover: /cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script> Created attachment 35464 [details] [review] Bug 13609: Cross Site Scripting problem in authority search result list paging To test: - Use an installation a reasonable amount of authorities, so that you can have a search result list with more than one page - Activate OpacAuthorities - Create an OPAC link like shown below, verify that an alert is shown - Apply patch - Refresh the page and no alert should appear - Verify the paging still works correctly for 'numbers' and 'arrows' URL: .../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script> Created attachment 35469 [details] [review] Bug 13609: Cross Site Scripting problem in authority search result list paging To test: - Use an installation a reasonable amount of authorities, so that you can have a search result list with more than one page - Activate OpacAuthorities - Create an OPAC link like shown below, verify that an alert is shown - Apply patch - Refresh the page and no alert should appear - Verify the paging still works correctly for 'numbers' and 'arrows' URL: .../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script> Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> I haven't done more tests yet, but I think for the earlier versions that still include the prog theme we need to fix the file there as well (problem was found in a 3.12). Will try to write one tonight, but happy if someone can provide one earlier. Created attachment 35474 [details] [review] [SIGNED OFF] Bug 13609: Cross Site Scripting problem in authority search result list paging To test: - Use an installation a reasonable amount of authorities, so that you can have a search result list with more than one page - Activate OpacAuthorities - Create an OPAC link like shown below, verify that an alert is shown - Apply patch - Refresh the page and no alert should appear - Verify the paging still works correctly for 'numbers' and 'arrows' URL: .../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script> Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com> Created attachment 35476 [details] [review] Bug 13609: Cross Site Scripting problem in authority search result list paging To test: - Use an installation a reasonable amount of authorities, so that you can have a search result list with more than one page - Activate OpacAuthorities - Create an OPAC link like shown below, verify that an alert is shown - Apply patch - Refresh the page and no alert should appear - Verify the paging still works correctly for 'numbers' and 'arrows' URL: .../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script> Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com> Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Created attachment 35477 [details] [review] Bug 13609: Patch for 3.16.x and 3.14.x (3.16.x needs both, 3.14.x just this) To Test: - Use an installation a reasonable amount of authorities, so that you can have a search result list with more than one page - Activate OpacAuthorities - Create an OPAC link like shown below, verify that an alert is shown - Apply patch - Refresh the page and no alert should appear - Verify the paging still works correctly for 'numbers' and 'arrows' URL: .../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script> Patch pushed to master. Thanks Katrina! Pushed to 3.14.x will be in 3.14.13 Is in 3.18.x and 3.16.x also |