From 13705e51084f605a0e9fc686e7ee30350fb556e2 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 2 Aug 2016 16:05:09 +0100 Subject: [PATCH] Bug 16800: Fix XSS in catalogue/*detail.tt - isbn MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Test plan: catalogue a bibliographic record with a isbn= Go on the detail pages. => Without this patch you will see the alert => With this patch, no more alert Signed-off-by: Chris Cormack Signed-off-by: Katrin Fischer Signed-off-by: Kyle M Hall Signed-off-by: Frédéric Demians --- koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt | 2 +- koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt index 886aabec52..79d376a478 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt @@ -479,7 +479,7 @@ function verify_images() {
    [% IF ( MARCISBNS ) %] -
  • ISBN:
      [% FOREACH MARCISBN IN MARCISBNS %]
    • [% MARCISBN %]
      • [% END %]
    • +
  • ISBN:
      [% FOREACH MARCISBN IN MARCISBNS %]
    • [% MARCISBN | html %]
      • [% END %]
    • [% ELSE %] [% IF ( normalized_isbn ) %]
  • ISBN: [% normalized_isbn %]
    • diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt index 4e6945720f..9fcd3f33cb 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt @@ -40,7 +40,7 @@
  • Item type: [% itemtypename %] 
    • [% END %] [% IF ( rentalcharge ) %]
  • Rental charge:[% rentalcharge %] 
    • [% END %] -
  • ISBN: [% isbn %] 
    • +
  • ISBN: [% isbn | html %] 
  • Publisher:[% place %] [% publishercode |html %] [% publicationyear %] 
    • [% IF ( volumeddesc ) %]
  • Volume: [% volumeddesc %]
    • [% END %]
  • Physical details: [% pages %] [% illus %] [% size %] 
    • -- 2.20.1