From d0ba676864eb2a55776d8dbd02d2403f9fa74a4b Mon Sep 17 00:00:00 2001 From: Chris Cormack Date: Thu, 5 Dec 2013 10:09:20 +1300 Subject: [PATCH] Bug 11341: fix XSS bug in opac-search.pl (facets) This patch fixes the prog theme; the bootstrap theme already does the necessary filtering. To test 1/ Craft a url like cgi-bin/koha/opac-search.pl?idx=kw&q=fish&offset=20" onmouseover%3dprompt(994000) bad%3d" (the search must return enough results to have a show more link in the facets) 2/ Check the source, or mouseover the Show more links in the facets Notice the code is executable 3/ Apply patch - notice it is no longer executable Signed-off-by: Tomas Cohen Arazi Signed-off-by: Brendan Gallagher Signed-off-by: Galen Charlton (cherry picked from commit d2d365ca830345b9a519158f6d735d2abd125380) Signed-off-by: Fridolin SOMERS --- koha-tmpl/opac-tmpl/prog/en/includes/opac-facets.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/opac-tmpl/prog/en/includes/opac-facets.inc b/koha-tmpl/opac-tmpl/prog/en/includes/opac-facets.inc index 04a18c6cff..414189659c 100644 --- a/koha-tmpl/opac-tmpl/prog/en/includes/opac-facets.inc +++ b/koha-tmpl/opac-tmpl/prog/en/includes/opac-facets.inc @@ -22,7 +22,7 @@ [% IF ( facets_loo.type_label_Location ) %]Locations[% END %] [% END %] -- 2.39.5