Bug 8973 - HTML and URL escape missing in OPAC templates
Summary: HTML and URL escape missing in OPAC templates
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: 3.6
Hardware: All All
: P5 - low normal (vote)
Target Milestone: ---
Assignee: Fridolin SOMERS
QA Contact: Paul Poulain
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-10-26 08:48 UTC by Fridolin SOMERS
Modified: 2013-12-05 20:01 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:


Attachments
Proposed patch (3.56 KB, patch)
2012-10-26 08:52 UTC, Fridolin SOMERS
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 8973: HTML and URL escape missing in OPAC templates (3.67 KB, patch)
2012-10-29 15:20 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 8973 [3.6.x] HTML and URL escape missing in OPAC templates (2.52 KB, patch)
2012-11-19 13:54 UTC, Owen Leonard
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Fridolin SOMERS 2012-10-26 08:48:27 UTC
In a few templates variables, the title or author are not html or url escaped.
This causes crash of email sharing for example (in opac-details.tt) when title contains a ".
Comment 1 Fridolin SOMERS 2012-10-26 08:52:08 UTC Comment hidden (obsolete)
Comment 2 Owen Leonard 2012-10-29 15:20:13 UTC Comment hidden (obsolete)
Comment 3 Paul Poulain 2012-10-30 17:23:06 UTC
QA comment: 
 * 3 lines patch that fix a  bug that could even be exploited for XSS injection
 * passes koha-qa.pl
 * no string change

passed QA
Comment 4 Paul Poulain 2012-10-30 17:23:31 UTC
Patch pushed to master
Comment 5 Chris Cormack 2012-10-30 22:15:05 UTC
Pushed to 3.8.x will be in 3.8.7
Comment 6 Liz Rea 2012-11-19 02:12:26 UTC
This does not apply for 3.6.x, please send a 3.6.x patch if it is needed.
Comment 7 Owen Leonard 2012-11-19 13:54:14 UTC
Created attachment 13514 [details] [review]
Bug 8973 [3.6.x] HTML and URL escape missing in OPAC templates

Adding HTML filter to some template variables which require them.
This patch is for 3.6.x, based on Fridolyn SOMERS patch for master.
Comment 8 Fridolin SOMERS 2012-11-20 08:27:43 UTC
I wanted to signoff 3.6 patch, but patch is already pushed in 3.6.x :
http://git.koha-community.org/gitweb/?p=koha.git;a=commit;h=b28598369ac95a971293ec79157593bb22b38ee7