From f59fbdbef1f79e0940305d7d153ae22121d1004b Mon Sep 17 00:00:00 2001
From: Chris <chris@bigballofwax.co.nz>
Date: Sun, 21 Jun 2015 09:20:51 +0000
Subject: [PATCH] Bug 14423 : Multiple XSS vulnerabilities in serials-search

To test

1/ Hit a url like http://localhost:8081/cgi-bin/koha/serials/serials-search.pl?bookseller_filter=%22%22%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&searched=1&title_filter=
2/ Notice alert boxes
3/ Apply patch
4/ Reload, notice fixed

Repeat for
callnumber_filter
EAN_filter
ISSN_filter
publisher_filter
title_filter

Signed-off-by: Mason James <mtj@kohaaloha.com>
---
 .../prog/en/modules/serials/serials-search.tt | 26 +++++++++----------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt
index 561e0329d6..dd651d522a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt
@@ -69,29 +69,29 @@
               <ol>
                 <li>
                   <label for="issn">ISSN:</label>
-                  <input type="text" id="issn" name="ISSN_filter" value="[% ISSN_filter %]" />
+                  <input type="text" id="issn" name="ISSN_filter" value="[% ISSN_filter | html %]" />
                 </li>
                 <li>
                   <label for="title">Title:</label>
-                  <input type="text" id="title" name="title_filter" value="[% title_filter %]" />
+                  <input type="text" id="title" name="title_filter" value="[% title_filter | html %]" />
                 </li>
                 [% IF ( marcflavour == "UNIMARC" ) %]
                 <li>
                   <label for="ean">EAN:</label>
-                  <input type="text" id="ean" name="EAN_filter" value="[% EAN_filter %]" />
+                  <input type="text" id="ean" name="EAN_filter" value="[% EAN_filter | html %]" />
                 </li>
                 [% END %]
                 <li>
                   <label for="callnumber">Call number:</label>
-                  <input type="text" id="callnumber" name="callnumber_filter" value="[% callnumber_filter %]" />
+                  <input type="text" id="callnumber" name="callnumber_filter" value="[% callnumber_filter | html %]" />
                 </li>
                 <li>
                   <label for="publisher">Publisher:</label>
-                  <input type="text" id="publisher" name="publisher_filter" value="[% publisher_filter %]" />
+                  <input type="text" id="publisher" name="publisher_filter" value="[% publisher_filter | html %]" />
                 </li>
                 <li>
                   <label for="bookseller">Vendor:</label>
-                  <input type="text" id="bookseller" name="bookseller_filter" value="[% bookseller_filter %]" />
+                  <input type="text" id="bookseller" name="bookseller_filter" value="[% bookseller_filter | html %]" />
                 </li>
                 <li>
                   <label for="branch">Library:</label>
@@ -289,7 +289,7 @@
                         </td>
                         <td>
                           [% UNLESS subscription.cannotedit %]
-                            <a href="/cgi-bin/koha/serials/serials-search.pl?subscriptionid=[% subscription.subscriptionid %]&amp;op=reopen&amp;routing=[% subscription.routing %]&amp;searched=1&amp;title_filter=[% title_filter %]&amp;ISSN_filter=[% ISSN_filter %]&amp;EAN_filter=[% EAN_filter %]&amp;published_filter=[% publisher_filter %]&amp;bookseller_filter=[% bookseller_filter %]&amp;branch_filter=[% branch_filter %]" id="reopensub">Reopen</a>
+                            <a href="/cgi-bin/koha/serials/serials-search.pl?subscriptionid=[% subscription.subscriptionid %]&amp;op=reopen&amp;routing=[% subscription.routing %]&amp;searched=1&amp;title_filter=[% title_filter | uri %]&amp;ISSN_filter=[% ISSN_filter | uri %]&amp;EAN_filter=[% EAN_filter | uri %]&amp;published_filter=[% publisher_filter | uri %]&amp;bookseller_filter=[% bookseller_filter | uri %]&amp;branch_filter=[% branch_filter | uri %]" id="reopensub"> <i class="icon-repeat"></i> Reopen</a>
                           [% ELSE %]
                             Cannot edit
                           [% END %]
@@ -328,29 +328,29 @@
               <ol>
                 <li>
                   <label for="issn">ISSN:</label>
-                  <input type="text" id="issn" name="ISSN_filter" value="[% ISSN_filter %]" />
+                  <input type="text" id="issn" name="ISSN_filter" value="[% ISSN_filter | html %]" />
                 </li>
                 <li>
                   <label for="title">Title:</label>
-                  <input type="text" id="title" name="title_filter" value="[% title_filter %]" />
+                  <input type="text" id="title" name="title_filter" value="[% title_filter | html %]" />
                 </li>
                 [% IF ( marcflavour == "UNIMARC" ) %]
                 <li>
                   <label for="ean">EAN:</label>
-                  <input type="text" id="ean" name="EAN_filter" value="[% EAN_filter %]" />
+                  <input type="text" id="ean" name="EAN_filter" value="[% EAN_filter | html %]" />
                 </li>
                 [% END %]
                 <li>
                   <label for="callnumber">Call number:</label>
-                  <input type="text" id="callnumber" name="callnumber_filter" value="[% callnumber_filter %]" />
+                  <input type="text" id="callnumber" name="callnumber_filter" value="[% callnumber_filter | html %]" />
                 </li>
                 <li>
                   <label for="publisher">Publisher:</label>
-                  <input type="text" id="publisher" name="publisher_filter" value="[% publisher_filter %]" />
+                  <input type="text" id="publisher" name="publisher_filter" value="[% publisher_filter | html %]" />
                 </li>
                 <li>
                   <label for="bookseller">Vendor:</label>
-                  <input type="text" id="bookseller" name="bookseller_filter" value="[% bookseller_filter %]" />
+                  <input type="text" id="bookseller" name="bookseller_filter" value="[% bookseller_filter | html %]" />
                 </li>
                 <li>
                   <label for="branch">Library:</label>