Description
David Cook
2016-05-09 05:12:07 UTC
Actually it looks like /cgi-bin/koha/ilsdi.pl blocks multiple values, so that should be OK... In that case, I think that's all I've found. I'd suggest patching Koha::Plugins::Base for sure and backporting the existing patches back to 3.22 and 3.20... Actually it looks like 3.20.3 requires a lower-cased opacuserjs: OPAC3.20.3/cgi-bin/koha/opac-search.pl?expanded_options=1&expanded_options=opacuserjs&expanded_options=alert(%27Hello%27) Created attachment 51325 [details] [review] Bug 16476: Do not call CGI->param in list context, some more David, I have submitted a follow-up for the master branch. For stable branches, Rmaints should backport existing fixes. Created attachment 51347 [details] [review] Bug 16476: Do not call CGI->param in list context, some more Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Created attachment 51349 [details] [review] [PASSED QA] Bug 16476: Do not call CGI->param in list context, some more Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> (In reply to Jonathan Druart from comment #4) > David, I have submitted a follow-up for the master branch. > For stable branches, Rmaints should backport existing fixes. Thanks, Jonathan. And cheers for all the work that you and Owen have done on this one in all the other reports as well! Pushed to master for Koha 16.05, thanks Jonathan! Patch pushed to 3.22.x, will be in 3.22.7 Pushed to 3.20.x will be in 3.20.14 |