gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/opac
History
Jonathan Druart 40d22a14c6 Bug 31219: Prevent JS injection in patron extended attributes 
We are sanitizing other attributes but "extended patron attributes".

Test plan:
Make a patron attribute editable at the OPAC
Edit an existing patron, or register a new one
Use a script tag in the new value ("<script>alert("booh!")</script>" for
instance)
With this patch the value is remove if containing an HTML tag that is
not br b i em big small strong (see C4::Scrubber)

Signed-off-by: Mark Hofstetter <koha@trust-box.at>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit ddaa78bdab)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
 		2022-10-24 18:05:06 +02:00
..
clubs Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
errors Bug 26048: Use ErrorDocument middleware for Plack HTTP errors 2021-01-27 10:30:43 +01:00
external/overdrive Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
rss
…
sci Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
sco Bug 30199: Do not generate jwt if patron does not exist 2022-05-03 20:12:54 +00:00
svc Bug 29320: Update OverDrive availability to V2 2022-02-21 15:13:35 +00:00
ilsdi.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
maintenance.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
oai.pl
…
opac-ISBDdetail.pl Bug 3142: Use filter_by_for_holds where holdability is calculated 2022-02-10 17:14:23 +00:00
opac-MARCdetail.pl Bug 3142: Use filter_by_for_holds where holdability is calculated 2022-02-10 17:14:23 +00:00
opac-account-pay-return.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-account-pay.pl Bug 23215: Remove traces of the PayPal feature 2021-05-07 14:44:00 +02:00
opac-account.pl Bug 23215: Remove traces of the PayPal feature 2021-05-07 14:44:00 +02:00
opac-addbybiblionumber.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-alert-subscribe.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-article-request-cancel.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-authorities-home.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-authoritiesdetail.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-basket.pl Bug 18989: (QA follow-up) Make controllers use Koha::Biblio->hidden_in_opac 2021-05-12 14:12:07 +02:00
opac-blocked.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-browse.pl Bug 27200: (follow-up) Browse search interface update 2020-12-26 17:58:43 +01:00
opac-browser.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-changelanguage.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-course-details.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-course-reserves.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-detail.pl Bug 29418: Make detail rendering use the cleaned-up title for searching 2022-07-14 21:40:22 +02:00
opac-discharge.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-downloadcart.pl Bug 5087: Add server-side check 2020-07-23 11:17:27 +02:00
opac-downloadshelf.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-export.pl Bug 24108: Make export file names consistent 2021-02-17 16:28:25 +01:00
opac-holdshistory.pl Bug 20936: (follow-up) add biblio and item relation to old holds and set a limit on search holds 2020-11-11 15:55:48 +01:00
opac-ics.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-idref.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-illrequests.pl Bug 22818: Add generation and sending of notices 2020-11-11 08:35:10 +01:00
opac-image.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-imageviewer.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-issue-note.pl Bug 29544: (QA follow-up) Simplify code 2022-01-26 20:20:19 +00:00
opac-library.pl
…
opac-main.pl Bug 27650: Fix variable passed to the template in opac-main 2021-03-08 15:15:48 +01:00
opac-memberentry.pl Bug 31219: Prevent JS injection in patron extended attributes 2022-10-24 18:05:06 +02:00
opac-messaging.pl Bug 24663: Remove authnotrequired if set to 0 2020-09-03 10:40:35 +02:00
opac-modrequest-suspend.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-modrequest.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-mymessages.pl Bug 24663: Remove authnotrequired if set to 0 2020-09-03 10:40:35 +02:00
opac-news-rss.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-overdrive-search.pl Bug 29318: Remove permission check from overdrive search page 2021-10-29 11:41:33 -04:00
opac-passwd.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-password-recovery.pl Bug 29646: (RM follow-up) Add space before colon 2022-02-16 20:51:32 +00:00
opac-patron-consent.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-patron-image.pl Bug 29931: [21.05.x] Check cookie status before continuing 2022-03-09 15:09:19 +00:00
opac-privacy.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-ratings-ajax.pl
…
opac-ratings.pl
…
opac-readingrecord.pl Bug 28768: (QA follow-up) Remove unused variable 2021-11-11 07:27:05 -05:00
opac-recordedbooks-search.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-registration-verify.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-renew.pl Bug 24083: Add support for unseen_renewals 2020-11-11 16:09:58 +01:00
opac-reportproblem.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-request-article.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-reserve.pl Bug 29706: Hide items that cannot be held by default when placing hold on OPAC 2022-03-04 17:03:46 +00:00
opac-restrictedpage.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-retrieve-file.pl
…
opac-review.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-routing-lists.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-search-history.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-search.pl Bug 28847: (follow-up) Handle branch_group_limit 2021-11-22 13:37:19 -05:00
opac-sendbasket.pl Bug 22343: (QA follow-up) Wrap email creation inside the try/catch block 2020-10-02 10:54:41 +02:00
opac-sendshelf.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-serial-issues.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-shareshelf.pl Bug 28870: Move email address validation to a specific class method 2021-11-15 07:21:49 -05:00
opac-shelves.pl Bug 28764: (QA follow-up) Add comment, remove two defined's 2021-08-13 07:48:22 -04:00
opac-showmarc.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-showreviews.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-suggestions.pl Bug 29696: Preserve link to biblio when creating a suggestion 2022-01-10 15:25:45 +00:00
opac-tags.pl Bug 18989: (QA follow-up) Make controllers use Koha::Biblio->hidden_in_opac 2021-05-12 14:12:07 +02:00
opac-tags_subject.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-topissues.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-user.pl Bug 24083: Add support for unseen_renewals 2020-11-11 16:09:58 +01:00
tracklinks.pl Bug 27979: Modify TrackClicks to verify URL exists in DB when multiple uri 2021-04-16 12:28:18 +02:00
unapi
…