Bug 3652: close XSS vulnerabilities on biblionumber and authid
authorJared Camins-Esakov <jcamins@cpbibliography.com>
Mon, 15 Oct 2012 15:45:38 +0000 (11:45 -0400)
committerChris Cormack <chrisc@catalyst.net.nz>
Mon, 22 Oct 2012 04:01:44 +0000 (17:01 +1300)
commit94d3e6e713a6550004ead6f95953586ab814f982
treecbaa73f6b81d20939808094ff4d319e34ebe295c
parente7b91d6a823401f73d4ef69ae80e045031995dfc
Bug 3652: close XSS vulnerabilities on biblionumber and authid

Previously we did not sanitize biblionumber and authids passed in by
the user.

To test:
1) Go to /cgi-bin/koha/opac-detail.pl?biblionumber=2hi (substituting a
   valid biblionumber for the 2).
2) Notice the presence of "2hi" on this page, and also on the ISBD and
   MARC views.
3) Go to /cgi-bin/koha/opac-authoritiesdetail.pl?authid=2bye
   (substituting a valid authid for the 2).
4) Notice the presence of "2bye" on this page.
3) Apply patch.
4) Notice that "2hi" and "2bye" strings are gone.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
opac/opac-ISBDdetail.pl
opac/opac-MARCdetail.pl
opac/opac-authoritiesdetail.pl
opac/opac-detail.pl
opac/opac-showmarc.pl