629d2a6f6c
This change adds a "safe_url" filter which takes a text input and
returns a Perl URL object which stringifies to a safe URL.
This change is only needed in the OPAC as the staff interface
handles the item URL display using Javascript not Template Toolkit.
0. Apply patch and koha-plack --restart kohadev
1. Create an item for a record using the following URL
https://koha-community.org?url=https%3A%2F%2Fkoha-community.org
2. Go to the OPAC for that record and verify that the URL is
not double-escaped
3. Create a malicious payload (talk to QA/security team for this if necessary)
4. Note that the malicious payload is escaped
5. prove t/Koha/Plugins/SafeURL.t
6. Celebrate!
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| AdditionalContents.pm | ||
| Asset.pm | ||
| AudioAlerts.pm | ||
| AuthClient.pm | ||
| AuthorisedValues.pm | ||
| Biblio.pm | ||
| Branches.pm | ||
| Categories.pm | ||
| CirculationRules.pm | ||
| ClassSources.pm | ||
| Context.pm | ||
| Desks.pm | ||
| ExtendedAttributeTypes.pm | ||
| Frameworks.pm | ||
| HtmlId.pm | ||
| HtmlTags.pm | ||
| I18N.pm | ||
| ItemTypes.pm | ||
| JSConsents.pm | ||
| Koha.pm | ||
| KohaDates.pm | ||
| KohaPlugins.pm | ||
| KohaSpan.pm | ||
| Languages.pm | ||
| NoticeTemplates.pm | ||
| Notices.pm | ||
| Price.pm | ||
| Registers.pm | ||
| Remove_MARC_punctuation.pm | ||
| SafeURL.pm | ||
| TablesSettings.pm | ||
| To.pm | ||
| raw.pm | ||