gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

bug 3652 fixing XSS vulnerabilities in opac-search 

Signed-off-by: Mason James <mtj@kohaaloha.com>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
This commit is contained in:
Chris Hall 2012-10-17 14:32:19 +13:00 committed by Paul Poulain
parent 35b6a5ea11
commit d2de76d60d
3 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
koha-tmpl/opac-tmpl/prog/en/modules/opac-detail.tt
View File

@ -63,7 +63,7 @@
widgets : ['zebra'],
sortList: [[0,0]]
});
[% IF ( query_desc ) %][% IF ( OpacHighlightedWords ) %]var query_desc = "[% query_desc |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
[% IF ( query_desc ) %][% IF ( OpacHighlightedWords ) %]var query_desc = "[% query_desc |replace("'", "\'") |replace('\n', '\\n') |replace('\r', '\\r') |html %]";
q_array = query_desc.split(" ");
highlightOn();
$("#highlight_toggle_on" ).hide().click(function() {highlightOn() ; return false;});

2
koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tt
View File

@ -62,7 +62,7 @@ $(document).ready(function(){
return false;
});
[% IF ( query_desc ) %]
var query_desc = "[% query_desc |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
var query_desc = "[% query_desc |replace("'", "\'") |replace('\n', '\\n') |replace('\r', '\\r') |html %]";
q_array = query_desc.split(" ");
// ensure that we don't have "" at the end of the array, which can
// break the highlighter

2
koha-tmpl/opac-tmpl/prog/en/modules/opac-results.tt
View File

@ -207,7 +207,7 @@ $(document).ready(function(){
[% END %]
$("#holdDetails").hide();
[% IF ( query_desc ) %][% IF ( OpacHighlightedWords ) %]var query_desc = "[% query_desc |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
[% IF ( query_desc ) %][% IF ( OpacHighlightedWords ) %]var query_desc = "[% query_desc |replace("'", "\'") |replace('\n', '\\n') |replace('\r', '\\r') |html %]";
q_array = query_desc.split(" ");
// ensure that we don't have "" at the end of the array, which can
// break the highlighter