gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 17038: Fix XSS in catalogue/search.pl 

Test plan:
Search for something like:
  \";alert(1)//135

=> Without this patch you will see the alert
=> With this patch, no more alert

Note that this fix the parameters idx, q and op

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
This commit is contained in:
Jonathan Druart 2016-08-03 13:57:43 +01:00 committed by Chris Cormack
parent 852bc45253
commit e552cd64bb
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
View File

@ -131,7 +131,7 @@ $('#sort_by').change(function() {
$(".selection").show();
[% IF ( query_desc ) %]
toHighlight = $("p,span.results_summary,a.title");
var query_desc = "[% query_desc |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
var query_desc = "[% query_desc |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
q_array = query_desc.split(" ");
// ensure that we don't have "" at the end of the array, which can
// break the highlighter