gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 16800: Fix XSS in additem.pl 

Signed-off-by: Katrin Fischer  <katrin.fischer@bsz-bw.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 9734726846)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
This commit is contained in:
Jonathan Druart 2016-09-14 09:20:01 +01:00 committed by Frédéric Demians
parent 13705e5108
commit 5a4a65cdbb
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/labeledMARCdetail.tt
View File

@ -55,7 +55,7 @@
[% INCLUDE 'cat-toolbar.inc' %]
[% UNLESS ( popup ) %]
<h1>Labeled MARC biblio : [% biblionumber %] ( [% bibliotitle | html %] )</h1>
<h1>Labeled MARC biblio : [% biblionumber %] ( [% bibliotitle | html %] )</h1>
[% END %]
<p><b>With framework:
<select name="Frameworks" id="Frameworks" size="1" onchange="Changefwk(this);">

6
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/additem.tt
View File

@ -2,7 +2,7 @@
[% USE ColumnsSettings %]
[% INCLUDE 'doc-head-open.inc' %]
<title>Koha &rsaquo; Cataloging &rsaquo; [% title |html %] [% IF ( author ) %] by [% author %][% END %] (Record #[% biblionumber %]) &rsaquo; Items</title>
<title>Koha &rsaquo; Cataloging &rsaquo; [% title |html %] [% IF ( author ) %] by [% author | html %][% END %] (Record #[% biblionumber %]) &rsaquo; Items</title>
<link rel="stylesheet" type="text/css" href="[% interface %]/[% theme %]/css/datatables.css" />
[% INCLUDE 'doc-head-close.inc' %]
[% INCLUDE 'datatables.inc' %]
@ -138,7 +138,7 @@ function confirm_deletion() {
<div id="breadcrumbs">
<a href="/cgi-bin/koha/mainpage.pl">Home</a>
&rsaquo; <a href="/cgi-bin/koha/cataloguing/addbooks.pl">Cataloging</a>
&rsaquo; Edit <a href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% biblionumber %]">[% title |html %] [% IF ( author ) %] by [% author %][% END %] (Record #[% biblionumber %])</a>
&rsaquo; Edit <a href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% biblionumber %]">[% title |html %] [% IF ( author ) %] by [% author | html %][% END %] (Record #[% biblionumber %])</a>
&rsaquo; <a href="/cgi-bin/koha/cataloguing/additem.pl?biblionumber=[% biblionumber %]">Items</a>
</div>
@ -147,7 +147,7 @@ function confirm_deletion() {
<div id="bd">
<div id="yui-main">
<h1>Items for [% title |html %] [% IF ( author ) %] by [% author %][% END %] (Record #[% biblionumber %])</h1>
<h1>Items for [% title |html %] [% IF ( author ) %] by [% author | html %][% END %] (Record #[% biblionumber %])</h1>
[% IF ( barcode_not_unique ) %]<div class="dialog alert"><strong>Error saving item</strong>: Barcode must be unique.</div>[% END %]
[% IF ( no_next_barcode ) %]<div class="dialog alert"><strong>Error saving items</strong>: Unable to automatically determine values for barcodes. No item has been inserted.</div>[% END %]