]> git.koha-community.org Git - koha.git/commit
Bug 13425 - XSS in opac facets - Patch for master and 3.18
authorChris Cormack <chrisc@catalyst.net.nz>
Tue, 9 Dec 2014 23:47:30 +0000 (12:47 +1300)
committerChris Cormack <chrisc@catalyst.net.nz>
Wed, 10 Dec 2014 00:12:23 +0000 (13:12 +1300)
commit70d28ef1b2cf01f75aa37ea8ba024462c87abde6
tree4b4327aff1ee523662b3a8f114c9b1e7e0d309ce
parentb28f439a582a5eafbdfb32b2890d6b069ec2df7c
Bug 13425 - XSS in opac facets - Patch for master and 3.18

To Test
1/ Craft a url like /cgi-bin/koha/opac-search.pl?q=123&sort_by='"><script>prompt('Happy_Holidays')</script>&limit=123

It is important it must return results and facets

2/ Notice the js is executed
3/ Apply the patch test again

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Popup is gone after applying the patch. Facet link still shows it but does not execute. It's gone after clicking the link.
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-facets.inc