gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/opac
History
Jared Camins-Esakov ab16ea5b02 Bug 3652: close XSS vulnerabilities in opac-export 
The opac-export.pl script had a number of XSS vulnerabilities relating
to its error handling.

To test:
1) Go to /cgi-bin/koha/opac-export.pl?op=export&bib=2&format=<h2>evil</h2>
   (substituting a valid biblionumber for the '2')
2) Notice that "evil" is rendered as an h2 heading.
3) Apply patch.
4) Notice that you now see the h2 tags, and they are not rendered by
   the browser.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
 		2012-10-22 16:37:36 -04:00
..
errors Bug 4330 Fixing FSF statements 2012-07-12 21:15:40 -04:00
rss adding file just for creating the rss directory 2007-08-02 08:50:43 +00:00
sco Bug 8518 - Self checkout does not display debt amount if syspref AllowFineOverride is set to allow 2012-09-13 19:16:13 -04:00
changelanguage.pl Bug 4330 Fixing FSF statements 2012-07-12 21:15:40 -04:00
ilsdi.pl Bug 6752: Be stricter with utf-8 encoding of output 2012-02-19 15:51:19 -05:00
maintenance.pl Bug 4330 Fixing FSF statements 2012-07-12 21:15:40 -04:00
oai.pl Bug 4330 Fixing FSF statements 2012-07-12 21:15:40 -04:00
opac-ISBDdetail.pl Bug 3652: close XSS vulnerabilities on biblionumber and authid 2012-10-22 16:35:11 -04:00
opac-MARCdetail.pl Bug 3652: close XSS vulnerabilities on biblionumber and authid 2012-10-22 16:35:11 -04:00
opac-account.pl Bug 4330 : Fixing FSF address and copyright statements 2012-07-12 21:15:39 -04:00
opac-addbybiblionumber.pl Bug 6631: Anonymous users can create lists in OPAC 2012-02-19 21:00:00 -05:00
opac-alert-subscribe.pl Bug 4289: 'OpacPublic' feature 2011-01-19 14:30:34 +13:00
opac-authorities-home.pl Bug 5453 Move declarations out of conditionals in opac 2011-07-15 15:50:22 +12:00
opac-authoritiesdetail.pl Bug 3652: close XSS vulnerabilities on biblionumber and authid 2012-10-22 16:35:11 -04:00
opac-basket.pl Bug 4330 Fixing FSF statements 2012-07-12 21:15:40 -04:00
opac-browser.pl Bug 4289: 'OpacPublic' feature 2011-01-19 14:30:34 +13:00
opac-changelanguage.pl Bug 4330 Fixing FSF statements 2012-07-12 21:15:40 -04:00
opac-detail.pl Bug 3652: close XSS vulnerabilities on biblionumber and authid 2012-10-22 16:35:11 -04:00
opac-downloadcart.pl bug 5579 : Fixes several exports to embed items 2011-04-19 22:35:15 +12:00
opac-downloadshelf.pl Fix for Bug 3140 - It is possible to email someone else's private list 2011-05-26 09:50:52 +12:00
opac-export.pl Bug 3652: close XSS vulnerabilities in opac-export 2012-10-22 16:37:36 -04:00
opac-ics.pl Bug 7532 - remove dependency on Date::ICal 2012-02-19 21:00:38 -05:00
opac-main.pl Bug 4330 Fixing FSF statements 2012-07-12 21:15:40 -04:00
opac-messaging.pl Fix FSF address in directory opac/ 2010-03-16 20:17:54 -04:00
opac-modrequest.pl Fix FSF address in directory opac/ 2010-03-16 20:17:54 -04:00
opac-mymessages.pl Bug 4330 : Fixing FSF address and copyright statements 2012-07-12 21:15:39 -04:00
opac-passwd.pl Bug 4330 Fixing FSF statements 2012-07-12 21:15:40 -04:00
opac-privacy.pl Bug 4330 Fixing FSF statements 2012-07-12 21:15:40 -04:00
opac-readingrecord.pl Bug 4330 Fixing FSF statements 2012-07-12 21:15:40 -04:00
opac-renew.pl Bug 7551 : Can only renew for the user you are logged in as now 2012-02-19 21:00:30 -05:00
opac-reserve.pl Bug 6976 Close loophole allowing borrowers extra holds via opac 2012-10-12 22:00:09 -04:00
opac-review.pl Bug 4289: 'OpacPublic' feature 2011-01-19 14:30:34 +13:00
opac-search-history.pl Fix FSF address in directory opac/ 2010-03-16 20:17:54 -04:00
opac-search.pl Bug 4064 - Uninitialized variable errors in opac-search.pl 2012-10-12 21:22:11 -04:00
opac-sendbasket.pl Bug 4330 : Fixing FSF address and copyright statements 2012-07-12 21:15:39 -04:00
opac-sendshelf.pl Bug 3651 Follow-up, Require patron login to send shelves and baskets 2012-01-18 10:10:42 -05:00
opac-serial-issues.pl Bug 6195 : Opac user should not have serial manage tab 2011-04-19 13:29:01 +12:00
opac-shelves.pl Bug 4289: 'OpacPublic' feature 2011-01-19 14:30:34 +13:00
opac-showmarc.pl Bug 3652: close XSS vulnerabilities on biblionumber and authid 2012-10-22 16:35:11 -04:00
opac-showreviews.pl Bug 6679 :[SIGNED-OFF] Fixing some perlcritic violations in the opac 2012-08-11 07:29:14 -04:00
opac-suggestions.pl Bug 4330 Fixing FSF statements 2012-07-12 21:15:40 -04:00
opac-tags.pl Bug 8315 - fix 'C4::Output 3.02' errors in Koha 2012-08-11 07:29:37 -04:00
opac-tags_subject.pl Bug 4289: 'OpacPublic' feature 2011-01-19 14:30:34 +13:00
opac-topissues.pl Bug 6141 - html glitches causing problems to translator - 3.8.x 2012-08-11 07:29:24 -04:00
opac-user.pl Bug 4330 Fixing FSF statements 2012-07-12 21:15:40 -04:00
opac-userdetails.pl Fix FSF address in directory opac/ 2010-03-16 20:17:54 -04:00
opac-userupdate.pl Bug 3651 Follow-up, Require patron login to send shelves and baskets 2012-01-18 10:10:42 -05:00
unapi Bug 6679 :[SIGNED-OFF] Fixing some perlcritic violations in the opac 2012-08-11 07:29:14 -04:00