e8e00cfeb3
This change adds a "safe_url" filter which takes a text input and returns a Perl URL object which stringifies to a safe URL. This change is only needed in the OPAC as the staff interface handles the item URL display using Javascript not Template Toolkit. 0. Apply patch and koha-plack --restart kohadev 1. Create an item for a record using the following URL https://koha-community.org?url=https%3A%2F%2Fkoha-community.org 2. Go to the OPAC for that record and verify that the URL is not double-escaped 3. Create a malicious payload (talk to QA/security team for this if necessary) 4. Note that the malicious payload is escaped 5. prove t/Koha/Plugins/SafeURL.t 6. Celebrate! Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> |
||
|---|---|---|
| .. | ||
| AdditionalContents.pm | ||
| Asset.pm | ||
| AudioAlerts.pm | ||
| AuthClient.pm | ||
| AuthorisedValues.pm | ||
| Biblio.pm | ||
| Branches.pm | ||
| Categories.pm | ||
| CirculationRules.pm | ||
| ClassSources.pm | ||
| Context.pm | ||
| Desks.pm | ||
| ExtendedAttributeTypes.pm | ||
| Frameworks.pm | ||
| HtmlId.pm | ||
| HtmlTags.pm | ||
| I18N.pm | ||
| ItemTypes.pm | ||
| JSConsents.pm | ||
| Koha.pm | ||
| KohaDates.pm | ||
| KohaPlugins.pm | ||
| KohaSpan.pm | ||
| KohaTimes.pm | ||
| Languages.pm | ||
| NoticeTemplates.pm | ||
| Notices.pm | ||
| Price.pm | ||
| Registers.pm | ||
| Remove_MARC_punctuation.pm | ||
| SafeURL.pm | ||
| TablesSettings.pm | ||
| To.pm | ||
| raw.pm | ||