Koha/koha-tmpl/opac-tmpl/prog
Galen Charlton 60983cfeee kohabug 2026 - HTML-escape comments
This is a partial, perhaps temporary fix.  "<", ">",
and "&" characters in patron comments (AKA reviews)
are converted to "&lt;", "&gt;", and "&amp;" to avoid
certain attacks, e.g., a user entering a <script> tag
in a comment.

A more permanent fix should scrub all (or perhaps just
unsafe) tags from submitted comments entirely.

Signed-off-by: Joshua Ferraro <jmf@liblime.com>
2008-04-30 21:59:01 -05:00
..
en kohabug 2026 - HTML-escape comments 2008-04-30 21:59:01 -05:00
famfamfam Remove redundant zip file. 2008-04-22 18:06:29 -05:00
images Improving comments style and markup, adding highlighting for comments made by logged-in user. 2008-04-01 06:45:48 -05:00
itemtypeimg Removing duplicate itemtype icons. 2008-04-25 07:09:30 -05:00