Liz 52fe123891 Bug 13510 - Cross site scripting bug in opac-downloadshelf and opac-shelves ... A specially crafted url causes XSS in Koha To test: cgi-bin/koha/opac-shelves.pl?viewshelf=2%22%3E%3Cscript%3Eprompt(987898)%3C/script%3E cgi-bin/koha/opac-downloadshelf.pl?shelfid=2%22%3Cscript%3Eprompt(1)%3C/script%3E&showprivateshelves These should cause a popup without the patch. With the patch, no popup. You may need to create these lists, the xss will not be triggered if the list doesn't exist or you don't have permission to view them. Signed-off-by: Chris <chris@bigballofwax.co.nz> Fixes the two listed problems Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> Confirmed patch fixes the problem. Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>		2015-01-22 16:35:47 -03:00
..
errors	Bug 12763 [QA Followup] - Remove tabs and trailing space	2014-09-18 09:41:31 -03:00
sco	Bug 13422 - SCO: "Would you like to rpint a receipt" not translatable	2014-12-19 15:05:02 -03:00
svc	Bug 11951: fix OPAC search suggestions template error	2014-04-09 22:50:53 +00:00
text	Bug 10309 - New OPAC theme based on Bootstrap	2013-10-14 23:13:05 +00:00
ilsdi.tt	Bug 8868: Follow-up: Update boostrap documentation page	2014-09-18 09:49:25 -03:00
maintenance.tt	Bug 10309 - New OPAC theme based on Bootstrap	2013-10-14 23:13:05 +00:00
opac-account.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-addbybiblionumber.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-advsearch.tt	Bug 9043 [QA Followup] - Don't show "More options" are there aren't any	2014-11-10 12:25:55 -03:00
opac-alert-subscribe.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-auth-detail.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-auth-MARCdetail.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-auth.tt	BUG8446, Follow up: Improve local login fallback	2014-10-16 12:27:51 -03:00
opac-authorities-home.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-authoritiessearchresultlist.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-basket.tt	Bug 9214 - Show damaged status in the OPAC for items which are not for loan	2014-11-11 15:13:03 -03:00
opac-blocked.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-browser.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-course-details.tt	Bug 10632 [Follow-up] Enable datatables for courses and course details in the OPAC	2014-11-11 16:07:33 -03:00
opac-course-reserves.tt	Bug 10632 [Follow-up] Enable datatables for courses and course details in the OPAC	2014-11-11 16:07:33 -03:00
opac-detail.tt	Bug 13449 - Syndetics TOC will not display in some cases	2014-12-17 20:21:50 -03:00
opac-downloadcart.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-downloadshelf.tt	Bug 13510 - Cross site scripting bug in opac-downloadshelf and opac-shelves	2015-01-22 16:35:47 -03:00
opac-full-serial-issues.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-imageviewer.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-ISBDdetail.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-main.tt	BUG8446, Follow up: Remove unnecessary sysprefs, move to config	2014-10-16 12:27:49 -03:00
opac-MARCdetail.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-memberentry-update-submitted.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-memberentry.tt	Bug - 11345 - Self registration captcha	2015-01-21 11:07:52 -03:00
opac-messaging.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-mymessages.tt	Bug 10309 - New OPAC theme based on Bootstrap	2013-10-14 23:13:05 +00:00
opac-opensearch.tt	Bug 11308: fix RSS page in bootstrap theme	2013-11-27 15:50:19 +00:00
opac-overdrive-search.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-passwd.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-privacy.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-readingrecord.tt	Bug 13234 [Follow-up] Make on-site checkouts visible in OPAC	2014-11-19 11:33:36 -03:00
opac-registration-confirmation.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-registration-email-sent.tt	Bug 13095: An email will be sent shortly	2014-10-28 10:46:18 -03:00
opac-registration-invalid.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-reserve.tt	Bug 13116 - Make it possible to propagate errors from C4::Reserves::CanItemBeReserved() to the web-templates.	2014-11-12 11:23:41 -03:00
opac-results-grouped.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-results.tt	Bug 11944: remove url/uri filter from query_cgi	2015-01-13 13:07:41 -03:00
opac-review.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-search-history.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-sendbasket.tt	Bug 11357 - biblioitems.size value not correctly displayed in list emails sent from OPAC and intranet	2014-07-01 15:29:29 +12:00
opac-sendbasketform.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-sendshelf.tt	Bug 11357 - biblioitems.size value not correctly displayed in list emails sent from OPAC and intranet	2014-07-01 15:29:29 +12:00
opac-sendshelfform.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-serial-issues.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-shareshelf.tt	Bug 13095: An email will be sent shortly	2014-10-28 10:46:18 -03:00
opac-shelves.tt	Bug 13510 - Cross site scripting bug in opac-downloadshelf and opac-shelves	2015-01-22 16:35:47 -03:00
opac-showmarc.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-showreviews-rss.tt	Bug 10309 - New OPAC theme based on Bootstrap	2013-10-14 23:13:05 +00:00
opac-showreviews.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-suggestions.tt	Bug 13329: Fix create a suggestion at the OPAC	2014-11-25 15:24:21 -03:00
opac-tags.tt	Bug 13119 - Use XSLT to display tagged titles in the OPAC	2015-01-04 11:28:11 -03:00
opac-tags_subject.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-topissues.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00
opac-user.tt	Bug 12162 - Add class="branchcode" to body tag to make OPAC CSS-styleable per branch	2014-09-23 15:39:31 -03:00