In a few templates variables, the title or author are not html or url escaped.
This causes crash of email sharing for example (in opac-details.tt) when title contains a ".
Created attachment 13070 [details] [review]
Created attachment 13098 [details] [review]
[SIGNED-OFF] Bug 8973: HTML and URL escape missing in OPAC templates
Signed-off-by: Owen Leonard <email@example.com>
* 3 lines patch that fix a bug that could even be exploited for XSS injection
* passes koha-qa.pl
* no string change
Patch pushed to master
Pushed to 3.8.x will be in 3.8.7
This does not apply for 3.6.x, please send a 3.6.x patch if it is needed.
Created attachment 13514 [details] [review]
Bug 8973 [3.6.x] HTML and URL escape missing in OPAC templates
Adding HTML filter to some template variables which require them.
This patch is for 3.6.x, based on Fridolyn SOMERS patch for master.
I wanted to signoff 3.6 patch, but patch is already pushed in 3.6.x :