Commit graph

7 commits

Author SHA1 Message Date
Chris Hall
d2de76d60d bug 3652 fixing XSS vulnerabilities in opac-search
Signed-off-by: Mason James <mtj@kohaaloha.com>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
2012-10-24 15:44:07 +02:00
Jared Camins-Esakov
ba9c71f04f Bug 8525: highlight matches on OPAC detail page
After doing a search and going to the details page, it can sometimes
be difficult to see exactly *why* a record was returned by a search.
By highlighting matches on the detail page as well as the results
page, we make it much easier to figure that out.

This patch uses a query_desc CGI parameter which is inserted into links
from the results page with javascript. This serves to avoid the
potential privacy implications of a cookie, and ensures that users
without javascript enabled see no change whatsoever.

To test:
1) Do a search (or two) in the OPAC with OpacHighlightedWords on.
2) View a record or two of the results, and ensure that the correct
   words are highlighted.
3) Disable OpacHighlightedWords and do another search (or two),
   this time ensuring that no words are highlighted.

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2012-09-03 09:58:28 +02:00
Robin Sheat
e9e95e218f Bug 8646 - prevent the highlighter from going infinite loop
On certain search queries, for example
http://koha-intra/cgi-bin/koha/catalogue/search.pl?kw=idx&q=ti:book%20
the highlighter starts going into an infinite loop until the browser
decides to kill it.

This patch prevents the bad input going to the highlighter.

It also includes the fix on the OPAC, even though the issue doesn't come
up there. Better to be safe...

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
2012-08-31 23:34:28 +02:00
ff7417fa91 Bug 8679 [REVISED] Remove usage of Amazon API
This patch removes the AmazonReviews and AmazonSimilarItems
features from the OPAC and staff client. With on Amazon
feature remaining, cover images, the *AmazonEnabled preference
is also removed in favor of checking the *AmazonCoverImages
preference. Two other system preferences, AWSAccessKeyID and
AWSPrivateKey are removed as they were required only by the
removed features.

Handling of book cover images from Amazon is unchanged.

Signed-off-by: Nicole C. Engard <nengard@bywatersolutions.com>

Turned on amazon covers in opac and staff client and all
worked as expected. Then tested to make sure other cover image
services still worked and they do.

Signing off.

Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
2012-08-29 16:05:29 +02:00
3a0b35cfbc Bug 2780 - Capitalize strings consistently (OPAC pages)
Correcting capitalization in OPAC templates

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Passes tests, changes look consistent by reading through the patch.

What a doozy!

Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
2012-04-06 18:27:55 +02:00
Frère Sébastien Marie
48173560ba Bug 7316 - Missing escaping in search results
Two parameters are now escaped in title (html element):
 - query_desc
 - limit_desc

This is a security correction against XSS.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
2011-12-09 16:01:23 +01:00
Chris Cormack
5884fb1000 Bug 5917 : Swapping templates over 2011-04-10 20:38:30 +12:00
Renamed from koha-tt/opac-tmpl/prog/en/modules/opac-results-grouped.tt (Browse further)