gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 38468: Add double quotes to some template strings 

This change adds double quotes to some template strings where
quotes are missing all together or single quotes are used incorrectly.

Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=test
2. Click on "Gairm"
3. Use the search result navigation box to go to the next result
   On the left of the page. Just bellow the breadcrumb and
   left of the record title.
4. Note that everything loads correctly

5. To test that the security hole has been fixed, try some of the
proof-of-concept attacks provided for biblionumber and searchid

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 6456c0b98d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This commit is contained in:
David Cook 2024-11-18 04:14:37 +00:00 committed by Fridolin Somers
parent 1ed737eb40
commit 1065ec6aab
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
koha-tmpl/intranet-tmpl/prog/en/includes/catalog-strings.inc
View File

@ -2,7 +2,7 @@
<!-- catalog-strings.inc -->
<script>
/* Some required variables from the template */
var biblionumber = [% biblionumber | html %];
var biblionumber = "[% biblionumber | html %]";
var count = [% count || 0 | html %];
var holdcount = [% holdcount || 0 | html %];
[% SET orders = biblio.orders %]
@ -11,7 +11,7 @@
var countorders = [% current.count || 0 | html %];
var countdeletedorders = [% cancelled.count || 0 | html %];
var subscriptionscount = [% biblio.subscriptions.count || 0 | html %];
var searchid = '[% searchid | html %]';
var searchid = "[% searchid | html %]";
/* provide Z3950 search points */
function GetZ3950Terms(){

2
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt
View File

@ -1826,7 +1826,7 @@
[% Asset.js("js/place_booking_modal.js") | $raw %]
<script>
var browser;
browser = KOHA.browser('[% searchid | html %]', parseInt(biblionumber, 10));
browser = KOHA.browser("[% searchid | html %]", parseInt(biblionumber, 10));
browser.show();
[% IF bundlesEnabled %]