gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/opac
History
Jonathan Druart c20974570d Bug 20982: Sanitize category to prevent XSS on opac-shelves.pl 
== Test plan ==
1. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?category=function(){window.location.href%20=%20%27https://git.koha-community.org/stats/koha-master/authors.html%27}()
2. Note that you are redirected to another website
3. Apply the patch & restart services
4. Repeat the above and you are not redirected

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
 		2021-05-25 14:38:10 +00:00
..
clubs Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
errors
…
external/overdrive
…
rss
…
sci Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
sco Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
svc Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
ilsdi.pl Bug 24537: Tidy code 2020-04-06 11:01:03 +01:00
maintenance.pl
…
oai.pl
…
opac-ISBDdetail.pl Bug 18936: (follow-up) Fix tests, replace old get_onshelfholds_policy method 2020-02-04 09:56:25 +00:00
opac-MARCdetail.pl Bug 21395: Make perlcritic happy 2020-07-13 16:44:43 +00:00
opac-account-pay-paypal-return.pl Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
opac-account-pay-return.pl Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
opac-account-pay.pl Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
opac-account.pl Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
opac-addbybiblionumber.pl Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
opac-alert-subscribe.pl Bug 21395: Make perlcritic happy 2020-07-13 16:44:43 +00:00
opac-article-request-cancel.pl Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
opac-authorities-home.pl Bug 21395: Make perlcritic happy 2020-07-13 16:44:43 +00:00
opac-authoritiesdetail.pl Bug 21395: Make perlcritic happy 2020-07-13 16:44:43 +00:00
opac-basket.pl Bug 5087: (QA follow-up) Rename the attribute to fit later API usage 2020-07-30 17:01:53 +00:00
opac-blocked.pl
…
opac-browse.pl Bug 24545: Fix newly added files 2020-02-24 13:31:27 +00:00
opac-browser.pl
…
opac-changelanguage.pl Bug 21299: (QA follow-up) Rename module and subroutine 2018-11-07 21:52:17 +00:00
opac-course-details.pl
…
opac-course-reserves.pl
…
opac-detail.pl Bug 26133: Remove GetMarc* calls in detail.pl 2020-08-13 18:06:29 +00:00
opac-discharge.pl Bug 23723: using exit inside eval to stop sending output to browser doesn't work under plack 2019-10-07 12:21:30 +01:00
opac-downloadcart.pl Bug 5087: Add server-side check 2020-07-30 17:02:57 +00:00
opac-downloadshelf.pl Bug 5087: Add server-side check 2020-07-30 17:02:57 +00:00
opac-export.pl Bug 22075: Fix encoding problem with RIS export in OPAC 2019-04-11 11:47:17 +00:00
opac-ics.pl Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
opac-idref.pl
…
opac-illrequests.pl Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
opac-image.pl
…
opac-imageviewer.pl
…
opac-issue-note.pl Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
opac-library.pl Bug 13388: Add library pages to the OPAC 2020-05-04 09:11:03 +01:00
opac-main.pl Bug 27650: Fix variable passed to the template in opac-main 2021-03-14 19:56:32 +00:00
opac-memberentry.pl Bug 27626: Fix self registration if categorycode is hidden and PatronSelfRegistrationVerifyByEmail 2021-03-04 21:24:42 +00:00
opac-messaging.pl Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
opac-modrequest-suspend.pl Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
opac-modrequest.pl Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
opac-mymessages.pl Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
opac-news-rss.pl
…
opac-overdrive-search.pl
…
opac-passwd.pl Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
opac-password-recovery.pl Bug 26904: OPAC password recovery allows regexp in email 2020-11-23 23:07:46 +00:00
opac-patron-consent.pl Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
opac-patron-image.pl
…
opac-privacy.pl Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
opac-ratings-ajax.pl
…
opac-ratings.pl
…
opac-readingrecord.pl Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
opac-recordedbooks-search.pl Bug 17602: Fix few minor QA issues 2018-10-01 13:56:56 +00:00
opac-registration-verify.pl Bug 23253: Fix OpacNavRight for self reg by email 2019-08-15 09:19:28 +01:00
opac-renew.pl Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
opac-reportproblem.pl Bug 4461: Use inbound_email_address to know if we display the dropdown list 2020-04-06 11:19:44 +01:00
opac-request-article.pl Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
opac-reserve.pl Bug 27529: Choose patron's branch or item's homebranch if following group rules and patron cannot choose branch 2021-04-25 16:36:13 +00:00
opac-restrictedpage.pl Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
opac-retrieve-file.pl
…
opac-review.pl Bug 25340: Pass biblio object to OPAC comments template 2020-05-04 08:53:37 +01:00
opac-routing-lists.pl Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
opac-search-history.pl Bug 23084: Replace grep {^$var$} with grep {$_ eq $var} 2020-02-17 10:44:45 +00:00
opac-search.pl Bug 28241: Fix regex to allow for content before and after comma 2021-05-25 13:07:46 +00:00
opac-sendbasket.pl Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
opac-sendshelf.pl Bug 24663: Remove authnotrequired if set to 0 2020-08-31 20:03:22 +00:00
opac-serial-issues.pl Bug 21395: Make perlcritic happy 2020-07-13 16:44:43 +00:00
opac-shareshelf.pl Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
opac-shelves.pl Bug 20982: Sanitize category to prevent XSS on opac-shelves.pl 2021-05-25 14:38:10 +00:00
opac-showmarc.pl Bug 25009: Avoid leakages in opac-showmarc.pl 2020-04-27 10:44:10 +01:00
opac-showreviews.pl Bug 21395: Make perlcritic happy 2020-07-13 16:44:43 +00:00
opac-suggestions.pl Bug 27230: Display OPAC description for OPAC_SUG 2021-01-04 21:58:14 +00:00
opac-tags.pl Bug 23276: Do not display tag if pref TagsEnabled is off 2020-06-17 22:35:51 +00:00
opac-tags_subject.pl
…
opac-topissues.pl
…
opac-user.pl Bug 26388: Do not show 'Renew all' or 'Renew selected' if no renewable items 2020-09-14 22:19:34 +00:00
tracklinks.pl Bug 27979: Modify TrackClicks to verify URL exists in DB when multiple uri 2021-04-25 16:29:53 +00:00
unapi Bug 24052: Rename XSLT_Handler 2020-03-24 10:42:23 +00:00