From 65918b146cd88f38a9d894be8175d049ea70d05f Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Fri, 22 Jul 2016 08:14:27 +0100
Subject: [PATCH] Bug 16958: Fix XSS in opac-imageviewer.pl

Test plan:
Trigger
/opac-imageviewer.pl?biblionumber=14&imagenumber=7"><sCrIpT>alert(42)<%2fsCrIpT>

=> Without this patch you will see the JS alert
=> With this patch applied you won't see it

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
---
 .../opac-tmpl/bootstrap/en/modules/opac-imageviewer.tt      | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-imageviewer.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-imageviewer.tt
index 9598f4d47c..5985b9375f 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-imageviewer.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-imageviewer.tt
@@ -84,7 +84,7 @@
                         <div class="span9">
                             <div id="imageviewer">
                                 <div id="largeCover">
-                                    <img id="largeCoverImg" alt="" src="/cgi-bin/koha/opac-image.pl?imagenumber=[% imagenumber %]" />
+                                    <img id="largeCoverImg" alt="" src="/cgi-bin/koha/opac-image.pl?imagenumber=[% imagenumber | url %]" />
                                 </div>
                             </div> <!-- / #imageviewer -->
                         </div> <!-- / .span12 -->
@@ -94,7 +94,7 @@
                                 <div id="thumbnails">
                                     [% FOREACH img IN images %]
                                         [% IF img %]
-                                            <a href="/cgi-bin/koha/opac-imageviewer.pl?biblionumber=[% biblionumber %]&amp;imagenumber=[% img %]" onclick="showCover([% img %]); return false;">
+                                            <a href="/cgi-bin/koha/opac-imageviewer.pl?biblionumber=[% biblionumber | url %]&amp;imagenumber=[% img %]" onclick="showCover([% img %]); return false;">
                                             [% IF ( imagenumber == img ) %]
                                                 <img class="thumbnail selected" id="[% img %]" src="/cgi-bin/koha/opac-image.pl?imagenumber=[% img %]&amp;thumbnail=1" alt="Thumbnail"/>
                                             [% ELSE %]
@@ -120,7 +120,7 @@
     //<![CDATA[
         $(document).ready(function(){
             $("#largeCoverImg").attr("src","[% interface %]/[% theme %]/images/loading.gif");
-            showCover([% imagenumber %]);
+            showCover([% imagenumber | html %]);
         });
 
         function showCover(img) {
-- 
2.20.1