From 307d369a361e34a304d1de25f0d8cde5c05d5d98 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Wed, 9 Aug 2017 14:08:24 -0300 Subject: [PATCH] Bug 18726: Fix XSS at the OPAC - biblionumber The biblionumber parameter is sent by the user, we must escape all of them to avoid XSS. Fixes: Cross-site scripting OPAC pages Signed-off-by: Amit Gupta Signed-off-by: Marcel de Rooy Signed-off-by: Mason James --- .../bootstrap/en/includes/opac-bottom.inc | 6 +-- .../en/includes/opac-detail-sidebar.inc | 22 ++++++++--- .../bootstrap/en/modules/opac-ISBDdetail.tt | 2 +- .../bootstrap/en/modules/opac-MARCdetail.tt | 12 +++--- .../en/modules/opac-alert-subscribe.tt | 10 ++--- .../bootstrap/en/modules/opac-detail.tt | 37 +++++++++++-------- .../en/modules/opac-full-serial-issues.tt | 6 +-- .../en/modules/opac-serial-issues.tt | 2 +- 8 files changed, 56 insertions(+), 41 deletions(-) diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc index 1a1337087c..b02f61cf6a 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc +++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc @@ -155,15 +155,15 @@ $.widget.bridge('uitooltip', $.ui.tooltip); return false; }); $("#ulactioncontainer > ul > li > a.addtoshelf").on("click",function(){ - Dopop('opac-addbybiblionumber.pl?biblionumber=[% biblionumber %]'); + Dopop('opac-addbybiblionumber.pl?biblionumber=[% biblionumber | html %]'); return false; }); $(".addrecord").on("click",function(){ - addRecord('[% biblionumber %]'); + addRecord('[% biblionumber | html %]'); return false; }); $(".cartRemove").on("click",function(){ - delSingleRecord('[% biblionumber %]'); + delSingleRecord('[% biblionumber | html %]'); return false; }); //]]> diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc index 3c14bea690..3e0119a21b 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc +++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc @@ -3,22 +3,32 @@ [% IF Koha.Preference( 'opacuserlogin' ) == 1 %] [% IF Koha.Preference( 'RequestOnOpac' ) == 1 %] [% IF ( AllowOnShelfHolds OR ItemsIssued ) %] -
  • Place hold
    • +
  • Place hold
    • [% END %] [% END %] [% END %] [% END %]
  • Print
    • +<<<<<<< HEAD +======= + + [% IF Koha.Preference( 'opacuserlogin' ) == 1 %] + [% IF Koha.Preference('ArticleRequests') %] +
  • Request article
    • + [% END %] + [% END %] + +>>>>>>> Bug 18726: Fix XSS at the OPAC - biblionumber [% IF Koha.Preference( 'virtualshelves' ) == 1 %] [% IF ( ( Koha.Preference( 'opacuserlogin' ) == 1 ) && loggedinusername ) %] -
  • Save to your lists
    • +
  • Save to your lists
    • [% END %] [% END %] [% IF Koha.Preference( 'opacbookbag' ) == 1 %] [% IF ( incart ) %] -
  • In your cart (remove)
    • +
  • In your cart (remove)
    • [% ELSE %] -
  • Add to your cart
    • +
  • Add to your cart
    • [% END %] [% END %] [% IF ( OpacHighlightedWords && query_desc ) %] @@ -40,7 +50,7 @@
  • Dublin Core
    • [% ELSE %]
  • - + [% SWITCH option %] [% CASE 'bibtex' %]BIBTEX [% CASE 'endnote' %]EndNote @@ -96,7 +106,7 @@
    - +
    diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-ISBDdetail.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-ISBDdetail.tt index 108b9bfba0..42d5f79dc0 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-ISBDdetail.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-ISBDdetail.tt @@ -19,7 +19,7 @@
    [% ISBD %]
    diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-MARCdetail.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-MARCdetail.tt index 1f0680e7fa..db570b32a1 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-MARCdetail.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-MARCdetail.tt @@ -1,6 +1,6 @@ [% USE Koha %] [% INCLUDE 'doc-head-open.inc' %] -[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog › MARC details for record no. [% biblionumber %] +[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog › MARC details for record no. [% biblionumber | html %] [% INCLUDE 'doc-head-close.inc' %] [% BLOCK cssinclude %][% END %] @@ -20,14 +20,14 @@
    - Normal view + Normal view MARC view - [% IF ( ISBD ) %]ISBD view[% END %] + [% IF ( ISBD ) %]ISBD view[% END %]
    -

    [% bibliotitle %] (Record no. [% biblionumber %])

    +

    [% bibliotitle %] (Record no. [% biblionumber | html %])

    [% IF ( OPACXSLTDetailsDisplay ) %] - +
    [% END %] @@ -190,7 +190,7 @@ $(document).ready(function(){ $(this).text(_("view labeled")); $("#labeledmarc").hide(); if(!loaded){ - $("#plainmarc").show().html("
    "+_("Loading")+"...
    ").load("/cgi-bin/koha/opac-showmarc.pl","id=[% biblionumber %]&viewas=html"); + $("#plainmarc").show().html("
    "+_("Loading")+"...
    ").load("/cgi-bin/koha/opac-showmarc.pl","id=[% biblionumber | html %]&viewas=html"); loaded = 1; } else { $("#plainmarc").show(); diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscribe.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscribe.tt index d4b79c5e3d..c4f581f337 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscribe.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscribe.tt @@ -10,7 +10,7 @@
    @@ -26,10 +26,10 @@ [% IF ( notes ) %]

    [% notes %]

    [% END %] - + - No + No [% END %] [% IF ( typeissuecancel ) %] @@ -40,10 +40,10 @@ [% IF ( notes ) %]

    [% notes %]

    [% END %] - + - No + No [% END %]
    diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt index bc18a6dac5..4c744e64d5 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt @@ -55,7 +55,7 @@
    [% IF ( OPACLocalCoverImages ) %] -
    +
    [% END %] [% IF ( OPACAmazonCoverImages ) %] [% IF ( OPACURLOpenInNewWindow ) %] @@ -103,15 +103,15 @@ [% END %]
    - + [% IF ( ocoins ) # COinS / Openurl %] [% END %]
    Normal view - MARC view - [% IF ( ISBD ) %]ISBD view[% END %] + MARC view + [% IF ( ISBD ) %]ISBD view[% END %]
    [% IF ( OPACXSLTDetailsDisplay ) %] [% XSLTBloc %] @@ -407,16 +407,16 @@ [% END %] [% IF ( TagsInputEnabled ) %] [% IF ( loggedinusername ) %] - -