Bug 11341: fix XSS bug in opac-search.pl (facets)
authorChris Cormack <chrisc@catalyst.net.nz>
Wed, 4 Dec 2013 21:09:20 +0000 (10:09 +1300)
committerTomas Cohen Arazi <tomascohen@gmail.com>
Tue, 17 Dec 2013 19:02:28 +0000 (16:02 -0300)
commit6e9dbec3c9c2cd851c77b25b6ced190b2bbbea6d
tree0d4b42e464b931bb6b140ce3a4931bb05507e9bc
parentc1f8e2757ddffd98d1ae34d011e5f0c97bcbb9e2
Bug 11341: fix XSS bug in opac-search.pl (facets)

This patch fixes the prog theme; the bootstrap theme already
does the necessary filtering.

To test
1/ Craft a url like
 cgi-bin/koha/opac-search.pl?idx=kw&q=fish&offset=20" onmouseover%3dprompt(994000) bad%3d"
 (the search must return enough results to have a show more link in the facets)

2/ Check the source, or mouseover the Show more links in the facets
   Notice the code is executable

3/ Apply patch - notice it is no longer executable

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit d2d365ca830345b9a519158f6d735d2abd125380)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit d0ba676864eb2a55776d8dbd02d2403f9fa74a4b)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
koha-tmpl/opac-tmpl/prog/en/includes/opac-facets.inc