Bug 8973

Summary: HTML and URL escape missing in OPAC templates
Product: Koha Reporter: Fridolin Somers <fridolin.somers>
Component: OPACAssignee: Fridolin Somers <fridolin.somers>
Status: CLOSED FIXED QA Contact: Paul Poulain <paul.poulain>
Severity: normal    
Priority: P5 - low CC: chris, liz, paul.poulain
Version: 3.6   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Proposed patch
[SIGNED-OFF] Bug 8973: HTML and URL escape missing in OPAC templates
Bug 8973 [3.6.x] HTML and URL escape missing in OPAC templates

Description Fridolin Somers 2012-10-26 08:48:27 UTC
In a few templates variables, the title or author are not html or url escaped.
This causes crash of email sharing for example (in opac-details.tt) when title contains a ".
Comment 1 Fridolin Somers 2012-10-26 08:52:08 UTC Comment hidden (obsolete)
Comment 2 Owen Leonard 2012-10-29 15:20:13 UTC Comment hidden (obsolete)
Comment 3 Paul Poulain 2012-10-30 17:23:06 UTC
QA comment: 
 * 3 lines patch that fix a  bug that could even be exploited for XSS injection
 * passes koha-qa.pl
 * no string change

passed QA
Comment 4 Paul Poulain 2012-10-30 17:23:31 UTC
Patch pushed to master
Comment 5 Chris Cormack 2012-10-30 22:15:05 UTC
Pushed to 3.8.x will be in 3.8.7
Comment 6 Liz Rea 2012-11-19 02:12:26 UTC
This does not apply for 3.6.x, please send a 3.6.x patch if it is needed.
Comment 7 Owen Leonard 2012-11-19 13:54:14 UTC
Created attachment 13514 [details] [review]
Bug 8973 [3.6.x] HTML and URL escape missing in OPAC templates

Adding HTML filter to some template variables which require them.
This patch is for 3.6.x, based on Fridolyn SOMERS patch for master.
Comment 8 Fridolin Somers 2012-11-20 08:27:43 UTC
I wanted to signoff 3.6 patch, but patch is already pushed in 3.6.x :
http://git.koha-community.org/gitweb/?p=koha.git;a=commit;h=b28598369ac95a971293ec79157593bb22b38ee7