gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/C4
History
Jonathan Druart e3f3f18b83 Bug 22478: Prevent XSS vulnerabilities when pagination appears 
This is a bad one as we thought we were XSS safe since bug 13618.

The html code generated in C4::Output::pagination_bar must escape the
variables and values correctly.

This patch needs to be widely tested, everywhere the pagination appears,
to make sure we will not introduce regressions.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit d4d1107afa)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f7b12a1cf3)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
 		2019-04-30 09:21:33 +02:00
..
AuthoritiesMarc Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
Barcodes Bug 14752 - (QA followup) Remove annoying modal, use dialog box instead 2016-09-13 17:21:05 +00:00
ClassSortRoutine Bug 16011: $VERSION - Remove use vars qw(); 2016-03-24 17:20:39 +00:00
Creators Bug 21281: (QA follow-up) Introduce _add_backtics 2018-10-03 13:52:13 +02:00
External Bug 17189: Replace occurrences of 'use Koha::Cache' 2016-09-08 10:24:47 +00:00
Form Bug 16259: Replace CGI->param with CGI->multi_param in list context - part 2 2016-05-16 17:28:06 +00:00
Heading Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
ILSDI Bug 21832: Restore is_expired in ILS-DI GetPatronInfo service 2019-04-24 09:50:19 +02:00
Installer Bug 21955: Remove Cache::Memory as fallback for L2 cache 2018-12-19 14:09:23 +01:00
Labels Bug 19040: Refactor GetMarcBiblio parameters 2017-08-25 10:23:42 -03:00
Linker Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Members Bug 17825: (followup) Remove unused function AttributeTypeExists 2017-03-31 14:37:21 +00:00
OAI Bug 18601: OAI/Sets.t mangles data due to truncate in ModOAISetsBiblios 2017-06-13 16:18:59 -03:00
Output Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Patroncards Bug 22429: Infinite loop in patron card printing 2019-03-26 07:25:29 +01:00
Reports Bug 19495: Automatic report conversion needs to do global replace on 'biblioitems' and 'marcxml' 2017-10-25 12:14:32 -03:00
SIP Bug 21020: Fix return branch on transfer - SIP 2018-07-12 08:33:59 +02:00
Search Bug 17323: Column search_history.time cannot be null 2016-11-18 13:51:37 +00:00
Serials Bug 16011: $VERSION - Remove comments 2016-03-24 17:20:29 +00:00
Utils Bug 20455: Fix sort patrons by date expired 2018-05-14 13:27:14 +00:00
Accounts.pm Bug 18677: Remove new issue_id param from charlostitem 2018-12-05 09:00:10 +01:00
Acquisition.pm Bug 18720: Use exception instead of die in GetBasketAsCsv 2018-11-28 14:34:18 +01:00
Auth.pm Bug 21323: Handle multi params in redirect after login 2018-10-03 13:56:42 +02:00
Auth_cas_servers.yaml.sample Bug 17065 - Rename C4/Auth_cas_servers.yaml.orig 2016-08-08 13:16:36 +00:00
Auth_with_cas.pm Bug 19373: CAS logout - Redirect to the previous page (Intranet) 2017-10-16 09:38:41 -03:00
Auth_with_ldap.pm Bug 18947: LDAP - do not assume anonymous bind if no user or password 2018-08-28 14:58:24 +02:00
Auth_with_shibboleth.pm Bug 12026: [QA Follow-up] Fix a POD line 2017-03-31 14:28:18 +00:00
AuthoritiesMarc.pm Bug 21962: Fix authority search using 'all' 2019-01-02 10:06:21 +01:00
BackgroundJob.pm Bug 16011: $VERSION - Remove empty BEGIN block 2016-03-24 17:20:41 +00:00
Barcodes.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
Biblio.pm Bug 21556: Do not crash if a biblio is deleted twice 2018-11-28 14:56:35 +01:00
Bookseller.pm Bug 14535: Update the supplier filter too 2017-03-31 12:38:44 +00:00
Boolean.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
Breeding.pm Bug 16011: $VERSION - Remove comments 2016-03-24 17:20:29 +00:00
Budgets.pm Bug 18999: Modified SQL query in GetBudgetSpent() in C4/Budgets.pm 2017-09-29 13:03:38 -03:00
Calendar.pm Bug 14572 - insert_single_holiday() forces a value on an AUTO_INCREMENT column, during an INSERT 2017-07-06 14:29:04 -03:00
Charset.pm Bug 18910: Revert "Bug 18152 : fix unimarc label in SetMarcUnicodeFlag" 2017-07-26 14:01:51 -03:00
Circulation.pm Bug 21849: Two useless Koha::Account::Offset->new calls need attention 2019-01-02 10:23:04 +01:00
ClassSortRoutine.pm Bug 16011: $VERSION - Remove comments 2016-03-24 17:20:29 +00:00
ClassSource.pm Bug 17208: Checking if classification source or filing rule already exists before adding 2016-12-23 11:33:48 +00:00
Context.pm Bug 19788: Preserve case sensitivity when creating Local preferences 2018-01-15 14:41:11 +00:00
Contract.pm Bug 16011: $VERSION - Remove comments 2016-03-24 17:20:29 +00:00
CourseReserves.pm Bug 10382: Course reserves: handle empty values 2018-10-24 10:57:11 +02:00
Creators.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
Debug.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
HTML5Media.pm Bug 21742: Fix YouTube variable propagation 2018-11-26 07:33:09 +01:00
Heading.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
HoldsQueue.pm Bug 19040: Refactor GetMarcBiblio parameters 2017-08-25 10:23:42 -03:00
Images.pm Bug 16011: $VERSION - Remove comments 2016-03-24 17:20:29 +00:00
ImportBatch.pm Bug 19937: Silence warnings t/db_dependent/www/batch.t 2018-01-23 01:42:07 +00:00
ImportExportFramework.pm Bug 18143: Silence ods MARC framework export flood 2019-03-12 09:17:06 +01:00
InstallAuth.pm Bug 19514: Add client-side check 2018-01-10 12:15:54 +00:00
Installer.pm Bug 21654: Remove refund_lost_item_fee_rules.sql from the installer process 2018-11-28 11:19:47 +01:00
ItemCirculationAlertPreference.pm Bug 15407: Koha::Patron::Categories - replace C4::Category->all 2016-09-08 13:29:03 +00:00
Items.pm Bug 21290: Updating documentation for ModItem 2019-02-12 16:32:03 +01:00
Koha.pm Bug 17843: Remove C4::Koha::getitemtypeinfo 2017-07-05 13:42:21 -03:00
Labels.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
Languages.pm Bug 16770: Remove wrong caching of 3 subroutines in C4::Lancuages 2016-06-24 14:05:56 +00:00
Letters.pm Bug 21829: Correctly format dateexpiry in notices (date only) 2019-02-22 09:12:58 +01:00
Linker.pm Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Log.pm Bug 19528: Fix a few typos like corrosponding 2017-10-27 14:09:04 -03:00
MarcModificationTemplates.pm Bug 19069: Fix 'does not match' behaviour in MARC modification template 2017-10-27 14:09:01 -03:00
Matcher.pm Bug 18131: Followup - Use data if biblionumber_tag < 10 2017-11-26 12:59:51 -03:00
Members.pm Bug 19920: Removed unnecessary code from C4/Members.pm 2019-02-04 13:04:54 +01:00
Message.pm Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
NewsChannels.pm Bug 19528: Fix a few typos like corrosponding 2017-10-27 14:09:04 -03:00
Output.pm Bug 22478: Prevent XSS vulnerabilities when pagination appears 2019-04-30 09:21:33 +02:00
Overdues.pm Bug 21196: Use replacement cost from the item type if not set at item level 2018-10-03 15:10:34 +02:00
Patroncards.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
Print.pm Bug 16011: $VERSION - Remove comments 2016-03-24 17:20:29 +00:00
Record.pm Bug 19040: Refactor GetMarcBiblio parameters 2017-08-25 10:23:42 -03:00
Reports.pm Bug 16011: $VERSION - Remove comments 2016-03-24 17:20:29 +00:00
Reserves.pm Bug 21075: AutoUnsuspendHolds should unsuspend holds <= today 2018-09-21 12:24:45 +02:00
Ris.pm Bug 16245: [QA Follow-up] Replace typeofrecord2 by biblevel 2016-10-21 14:51:55 +00:00
RotatingCollections.pm Bug 16011: $VERSION - Remove comments 2016-03-24 17:20:29 +00:00
SMS.pm Bug 19134: C4::SMS falils on long driver name 2017-08-25 10:51:24 -03:00
Scheduler.pm Bug 16011: $VERSION - Remove comments 2016-03-24 17:20:29 +00:00
Scrubber.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
Search.pm Bug 20151: always use current language for stemming 2018-10-15 16:55:49 +02:00
Serials.pm Bug 19528: Fix a few typos like corrosponding 2017-10-27 14:09:04 -03:00
Service.pm Bug 7550: [QA Follow-up] Resolve param warning from sco-patron-image 2017-05-08 09:00:26 -04:00
ShelfBrowser.pm Bug 19040: Refactor GetMarcBiblio parameters 2017-08-25 10:23:42 -03:00
SocialData.pm Bug 9978: (followup) Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:43 -03:00
Stats.pm Bug 18882: (QA follow-up) Ensure stats with no or undef location are set to NULL in db 2017-11-08 13:34:37 -03:00
Suggestions.pm Bug 17762: Send lang to GetPreparedLetter 2017-05-09 20:56:41 +00:00
TTParser.pm Bug 14383: C4: Fix some typos (mostly in comments and documentation) 2015-06-22 17:34:45 -03:00
Tags.pm Bug 16637: Dependency for C4::Tags not listed 2016-06-10 18:05:10 +00:00
Templates.pm Bug 17989: Resolve "verbatim paragraph in NAME section" warning in C4::Templates 2017-11-01 13:10:17 -03:00
TmplToken.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
TmplTokenType.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
UsageStats.pm Bug 21226: Remove xISBN services 2018-08-30 09:12:12 +02:00
XISBN.pm Bug 21226: Remove xISBN services 2018-08-30 09:12:12 +02:00
XSLT.pm Bug 18921: Resolve a few warnings in C4/XSLT.pm 2017-09-07 14:34:42 -03:00