https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37595 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |30969 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30969 [Bug 30969] Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl ) -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37595 --- Comment #2 from Owen Leonard <oleonard@myacpl.org> --- For this particular case it looks like we can convert the '&' to '&' in guided_reports.pl between line 974 and 979. Generally, it looks like we're using '&' in a lot of Perl code where I don't think we need to. For instance at line 345 of basketgroup.pl: print $input->redirect('/cgi-bin/koha/acqui/basketgroup.pl?booksellerid=' . $booksellerid.'&listclosed=1'); There's no need to encode that &. I'm guessing that in most places we use & it's because obsolete XHTML validator rules required us to. A current validator won't complain about it and I question whether there are places that require it for other reasons. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37595 --- Comment #4 from David Cook <dcook@prosentient.com.au> --- I'm not sure about bug 30969 either but... -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37595 --- Comment #5 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 170162 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=170162&action=edit Bug 37595: Double HTML escaped ampersand in pagination bar This patch removes escaping of ampersands in the part of guided_reports.pl that builds information for the pagination routine. The information is going to be escaped in a later step. To test, apply the patch and go to Reports. - If necessary, create a report which will return more than 20 results. - Run the report. You should see a pagination bar at the top of the table of results. - View the page source and look for the markup for the pagination menu. Searching for 'rel="start"' works well. - Confirm that you see '&' between the link parameters instead of '&amp;', e.g. guided_reports.pl?id=347&op=run&limit=20&want_full_chart=0&page=1 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37595 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #170162|0 |1 is obsolete| | --- Comment #6 from Fridolin Somers <fridolin.somers@biblibre.com> --- Created attachment 170170 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=170170&action=edit Bug 37595: Double HTML escaped ampersand in pagination bar This patch removes escaping of ampersands in the part of guided_reports.pl that builds information for the pagination routine. The information is going to be escaped in a later step. To test, apply the patch and go to Reports. - If necessary, create a report which will return more than 20 results. - Run the report. You should see a pagination bar at the top of the table of results. - View the page source and look for the markup for the pagination menu. Searching for 'rel="start"' works well. - Confirm that you see '&' between the link parameters instead of '&amp;', e.g. guided_reports.pl?id=347&op=run&limit=20&want_full_chart=0&page=1 Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37595 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #170170|0 |1 is obsolete| | --- Comment #7 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 170432 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=170432&action=edit Bug 37595: Double HTML escaped ampersand in pagination bar This patch removes escaping of ampersands in the part of guided_reports.pl that builds information for the pagination routine. The information is going to be escaped in a later step. To test, apply the patch and go to Reports. - If necessary, create a report which will return more than 20 results. - Run the report. You should see a pagination bar at the top of the table of results. - View the page source and look for the markup for the pagination menu. Searching for 'rel="start"' works well. - Confirm that you see '&' between the link parameters instead of '&amp;', e.g. guided_reports.pl?id=347&op=run&limit=20&want_full_chart=0&page=1 Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37595 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |24.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37595 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable CC| |lucas@bywatersolutions.com Version(s)|24.11.00 |24.11.00,24.05.06 released in| | --- Comment #9 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Backported to 24.05.x for upcoming 24.05.06 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37595 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldstable |Pushed to oldoldstable Version(s)|24.11.00,24.05.06 |24.11.00,24.05.06,23.11.11 released in| | --- Comment #10 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to 23.11.x for 23.11.11 -- You are receiving this mail because: You are watching all bug changes.