]> git.koha-community.org Git - koha.git/commit
projects / koha.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: e00e451) | patch
Bug 14360: Unescaped variable causes alert
authorAleisha <aleishaamohia@hotmail.com>
Mon, 8 Jun 2015 02:30:23 +0000 (02:30 +0000)
committerMason James <mtj@kohaaloha.com>
Sun, 21 Jun 2015 17:06:28 +0000 (05:06 +1200)
commit7cc24ec5e533ed750be02899d9fdc16b1396880e
tree012df18291e2ecbccfe26cbdc57b280d3f01728ftree | snapshot
parente00e451b6e06f615426d03e6933a3f3404b32acecommit | diff
Bug 14360: Unescaped variable causes alert

Adding |html to [% resultsperpage %] to escape the variable and get rid of the alert.

To test:

1) Go to URL such as ...  /cgi-bin/koha/opac-authorities-home.pl?op=do_search&resultsperpage=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
2) Notice pop-up box with alert
3) Apply patch, refresh page
4) Notice alert is gone

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt diff | blob | history
Main Koha release repository