gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/opac
History
Jared Camins-Esakov 35b6a5ea11 Bug 3652: close XSS vulnerabilities in opac-export 
The opac-export.pl script had a number of XSS vulnerabilities relating
to its error handling.

To test:
1) Go to /cgi-bin/koha/opac-export.pl?op=export&bib=2&format=<h2>evil</h2>
   (substituting a valid biblionumber for the '2')
2) Notice that "evil" is rendered as an h2 heading.
3) Apply patch.
4) Notice that you now see the h2 tags, and they are not rendered by
   the browser.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
 		2012-10-24 15:40:18 +02:00
..
errors Bug 4330 Fixing FSF statements 2012-05-28 17:53:51 +02:00
rss
…
sco Bug 8518 - Self checkout does not display debt amount if syspref AllowFineOverride is set to allow 2012-08-01 17:39:55 +02:00
svc Bug 8726: ExplodedTerms suggestion plugin (functionality) 2012-09-28 17:08:21 +02:00
changelanguage.pl Bug 6679: Fixing 5 perlcritic violations in opac/* 2012-06-10 15:12:39 +02:00
ilsdi.pl Bug 6752: Be stricter with utf-8 encoding of output 2012-01-27 12:11:06 +01:00
maintenance.pl Bug 4330 Fixing FSF statements 2012-05-28 17:53:51 +02:00
oai.pl Bug 4330 Fixing FSF statements 2012-05-28 17:53:51 +02:00
opac-ISBDdetail.pl Bug 3652 follow-up reverting call to param('bib') 2012-10-24 15:30:24 +02:00
opac-MARCdetail.pl Bug 3652 follow-up reverting call to param('bib') 2012-10-24 15:30:24 +02:00
opac-account.pl Bug 4330 : Fixing FSF address and copyright statements 2012-05-28 17:53:46 +02:00
opac-addbybiblionumber.pl Bug 7788: [SIGNED-OFF] Followup: GetShelf call in addbybiblio script corrected 2012-05-22 12:06:26 +02:00
opac-alert-subscribe.pl Bug 4289: 'OpacPublic' feature 2011-01-19 14:30:34 +13:00
opac-authorities-home.pl Bug 8206: Specify index in OPAC authority search 2012-09-07 15:16:40 +02:00
opac-authoritiesdetail.pl Bug 3652: close XSS vulnerabilities on biblionumber and authid 2012-10-24 15:23:50 +02:00
opac-basket.pl Bug 7570 - Add Item availability status to cart. 2012-06-11 17:50:41 +02:00
opac-browser.pl Bug 4289: 'OpacPublic' feature 2011-01-19 14:30:34 +13:00
opac-changelanguage.pl Bug 4330 Fixing FSF statements 2012-05-28 17:53:51 +02:00
opac-detail.pl Bug 3652: close XSS vulnerabilities on biblionumber and authid 2012-10-24 15:23:50 +02:00
opac-downloadcart.pl bug 5579 : Fixes several exports to embed items 2011-04-19 22:35:15 +12:00
opac-downloadshelf.pl Bug 7788: [SIGNED-OFF] Remove two unused calls to GetShelf 2012-05-22 12:06:25 +02:00
opac-export.pl Bug 3652: close XSS vulnerabilities in opac-export 2012-10-24 15:40:18 +02:00
opac-ics.pl Bug 5549 : GetPendingIssues now returns DateTime objects 2012-03-20 12:33:37 +13:00
opac-image.pl Bug 8255: allow local cover images to be cached 2012-06-25 18:12:29 +02:00
opac-imageviewer.pl Bug 4321: clean C4::Biblio::GetBiblio and uses 2012-09-18 12:11:54 +02:00
opac-main.pl Bug 8622: Fix theme fallback 2012-09-05 11:39:14 +02:00
opac-messaging.pl Talking Tech Support - Phase I 2012-06-10 17:46:52 +02:00
opac-modrequest-suspend.pl Bug 7641: Suspend Reserves 2012-03-29 14:37:49 +02:00
opac-modrequest.pl Fix FSF address in directory opac/ 2010-03-16 20:17:54 -04:00
opac-mymessages.pl Bug 4330 : Fixing FSF address and copyright statements 2012-05-28 17:53:46 +02:00
opac-passwd.pl Bug 4330 Fixing FSF statements 2012-05-28 17:53:51 +02:00
opac-patron-image.pl Bug 3516 [REVISED] Display picture of patrons in OPAC 2012-03-05 17:12:16 +01:00
opac-privacy.pl Bug 4330 Fixing FSF statements 2012-05-28 17:53:51 +02:00
opac-ratings-ajax.pl Bug 8315 - fix 'C4::Output 3.02' errors in Koha 2012-06-29 11:59:13 +02:00
opac-ratings.pl Bug 5668 - Star ratings in the opac 2012-04-10 14:40:49 +02:00
opac-readingrecord.pl Bug 8017 reduce manipulation of GetAllIssues return 2012-09-13 18:51:45 +02:00
opac-renew.pl Bug 7551 : Can only renew for the user you are logged in as now 2012-02-17 09:12:21 +01:00
opac-reserve.pl Bug 6976 Close loophole allowing borrowers extra holds via opac 2012-09-14 15:22:46 +02:00
opac-review.pl Bug 4289: 'OpacPublic' feature 2011-01-19 14:30:34 +13:00
opac-search-history.pl Fix FSF address in directory opac/ 2010-03-16 20:17:54 -04:00
opac-search.pl Bug 5409 - Fix call number not shown on opac search result page 2012-10-08 17:00:25 +02:00
opac-sendbasket.pl Bug 8626: Fix encoding in cart emails for use of quoted-printable 2012-08-29 18:14:32 +02:00
opac-sendshelf.pl Bug 3651 Follow-up, Require patron login to send shelves and baskets 2012-01-06 15:57:57 +01:00
opac-serial-issues.pl Bug 6195 : Opac user should not have serial manage tab 2011-04-19 13:29:01 +12:00
opac-shelves.pl Bug 7310: Code changes for Improving list permissions 2012-03-21 16:46:40 +01:00
opac-showmarc.pl Bug 3652: close XSS vulnerabilities on biblionumber and authid 2012-10-24 15:23:50 +02:00
opac-showreviews.pl Bug 6679 :[SIGNED-OFF] Fixing some perlcritic violations in the opac 2012-04-10 13:45:00 +02:00
opac-suggestions.pl Bug 4330 Fixing FSF statements 2012-05-28 17:53:51 +02:00
opac-tags.pl Bug 7642 - fix the lost display of tag sizes 2012-10-01 17:38:27 +02:00
opac-tags_subject.pl Bug 4289: 'OpacPublic' feature 2011-01-19 14:30:34 +13:00
opac-topissues.pl Bug 6141 - html glitches causing problems to translator 2012-06-10 12:59:49 +02:00
opac-user.pl Bug 8408 - Followup - Fix broken messages. 2012-09-07 18:42:06 +02:00
opac-userdetails.pl Fix FSF address in directory opac/ 2010-03-16 20:17:54 -04:00
opac-userupdate.pl Talking Tech Support - Phase I - Followup 2 - Bugfix 2012-06-10 17:47:01 +02:00
search.pl Bug 8233 : SearchEngine: Add a Koha::SearchEngine module 2012-07-06 16:51:58 +02:00
unapi Bug 6679 :[SIGNED-OFF] Fixing some perlcritic violations in the opac 2012-04-10 13:45:00 +02:00