gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 16800: Fix XSS in catalogue/*detail.tt - title 

Test plan:
catalogue a bibliographic record with a title=
  </title><script>alert('XSS')</script>

Go on the detail pages.
=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

This of course means that any html in the title will no longer be
evaluated. :

Signed-off-by: Katrin Fischer  <katrin.fischer@bsz-bw.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This commit is contained in:
Jonathan Druart 2016-08-02 16:02:07 +01:00 committed by Kyle M Hall
parent 69cbea8e0c
commit 515208d5ec
5 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/ISBDdetail.tt
View File

@ -3,7 +3,7 @@
[% IF ( unknownbiblionumber ) %]
Unknown record
[% ELSE %]
ISBD details for [% title %]
ISBD details for [% title | html %]
[% END %]
</title>
[% INCLUDE 'doc-head-close.inc' %]

2
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/MARCdetail.tt
View File

@ -3,7 +3,7 @@
[% IF ( unknownbiblionumber ) %]
Unknown record
[% ELSE %]
MARC details for [% bibliotitle %]
MARC details for [% bibliotitle | html %]
[% END %]
</title>
[% INCLUDE 'doc-head-close.inc' %]

4
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt
View File

@ -22,7 +22,7 @@
[% IF ( unknownbiblionumber ) %]
Unknown record
[% ELSE %]
Details for [% title |html %] [% FOREACH subtitl IN subtitle %] [% subtitl.subfield %][% END %]
Details for [% title |html %] [% FOREACH subtitl IN subtitle %] [% subtitl.subfield | html %][% END %]
[% END %]
</title>
@ -346,7 +346,7 @@ function verify_images() {
[% IF ( unknownbiblionumber ) %]
Unknown record
[% ELSE %]
Details for <i>[% title |html %] [% FOREACH subtitl IN subtitle %] [% subtitl.subfield %][% END %]</i>
Details for <i>[% title |html %] [% FOREACH subtitl IN subtitle %] [% subtitl.subfield | html %][% END %]</i>
[% END %]
</div>

6
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/labeledMARCdetail.tt
View File

@ -4,7 +4,7 @@
[% IF ( unknownbiblionumber ) %]
Unknown record
[% ELSE %]
Labeled MARC details for [% bibliotitle %]
Labeled MARC details for [% bibliotitle | html %]
[% END %]
</title>
@ -38,7 +38,7 @@
[% IF ( unknownbiblionumber ) %]
Unknown record
[% ELSE %]
MARC details for <i>[% bibliotitle %]</i>
MARC details for <i>[% bibliotitle | html %]</i>
[% END %]
</div>
@ -55,7 +55,7 @@
[% INCLUDE 'cat-toolbar.inc' %]
[% UNLESS ( popup ) %]
<h1>Labeled MARC biblio : [% biblionumber %] ( [% bibliotitle %] )</h1>
<h1>Labeled MARC biblio : [% biblionumber %] ( [% bibliotitle | html %] )</h1>
[% END %]
<p><b>With framework:
<select name="Frameworks" id="Frameworks" size="1" onchange="Changefwk(this);">

2
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt
View File

@ -1,7 +1,7 @@
[% USE Koha %]
[% USE Branches %]
[% INCLUDE 'doc-head-open.inc' %]
<title>Koha &rsaquo; Catalog &rsaquo; Item details for [% title %] [% FOREACH subtitl IN subtitle %] [% subtitl.subfield %][% END %]</title>
<title>Koha &rsaquo; Catalog &rsaquo; Item details for [% title | html %] [% FOREACH subtitl IN subtitle %] [% subtitl.subfield | html %][% END %]</title>
[% INCLUDE 'doc-head-close.inc' %]
<style type="text/css">h3{padding-top: 1em; border-top: 2px solid #CCCCCC;}#exportLabelexportModal_{border-top: 0px;}</style>
[% INCLUDE 'browser-strings.inc' %]