gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 13425 - XSS in opac facets - Patch for master and 3.18 

To Test
1/ Craft a url like /cgi-bin/koha/opac-search.pl?q=123&sort_by='"><script>prompt('Happy_Holidays')</script>&limit=123

It is important it must return results and facets

2/ Notice the js is executed
3/ Apply the patch test again

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Popup is gone after applying the patch. Facet link still shows it but does not execute. It's gone after clicking the link.
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
This commit is contained in:
Chris Cormack 2014-12-10 12:47:30 +13:00
parent b28f439a58
commit 70d28ef1b2
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-facets.inc
View File

@ -42,10 +42,10 @@
[% IF facet.active %]
[% SET url = url _ "&amp;nolimit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %]
<span class="facet-label">[% facet.facet_label_value %]</span>
[<a href="[% url %]" title="Remove facet [% facet.facet_link_value | html %]">x</a>]
[<a href="[% url |url%]" title="Remove facet [% facet.facet_link_value | html %]">x</a>]
[% ELSE %]
[% SET url = url _ "&amp;limit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %]
<span class="facet-label"><a href="[% url %]" title="[% facet.facet_title_value |html %]">[% facet.facet_label_value %]</a></span>
<span class="facet-label"><a href="[% url |url%]" title="[% facet.facet_title_value |html %]">[% facet.facet_label_value %]</a></span>
[% IF ( displayFacetCount ) %]
<span class="facet-count"> ([% facet.facet_count %])</span>
[% END %]