http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7316 Bug #: 7316 Summary: Missing escaping in search results Classification: Unclassified Change sponsored?: --- Product: Koha Version: unspecified Platform: All OS/Version: All Status: ASSIGNED Severity: critical Priority: P1 - high Component: Architecture, internals, and plumbing AssignedTo: semarie-koha@latrappe.fr ReportedBy: semarie-koha@latrappe.fr QAContact: ian.walls@bywatersolutions.com CC: paul.poulain@biblibre.com In opac (and intranet), in search results, two parameters need escaping in title (html element): - query_desc - limit_desc Impacted templates: koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tt koha-tmpl/opac-tmpl/prog/en/modules/opac-results.tt This is a security issue, as it could be used to perform XSS (I have tested). -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.