[Bug 7316] New: Missing escaping in search results
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7316 Bug #: 7316 Summary: Missing escaping in search results Classification: Unclassified Change sponsored?: --- Product: Koha Version: unspecified Platform: All OS/Version: All Status: ASSIGNED Severity: critical Priority: P1 - high Component: Architecture, internals, and plumbing AssignedTo: semarie-koha@latrappe.fr ReportedBy: semarie-koha@latrappe.fr QAContact: ian.walls@bywatersolutions.com CC: paul.poulain@biblibre.com In opac (and intranet), in search results, two parameters need escaping in title (html element): - query_desc - limit_desc Impacted templates: koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tt koha-tmpl/opac-tmpl/prog/en/modules/opac-results.tt This is a security issue, as it could be used to perform XSS (I have tested). -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7316 --- Comment #1 from Frère Sébastien Marie <semarie-koha@latrappe.fr> 2011-12-04 17:27:07 UTC --- Created attachment 6565 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=6565 Missing escaping in search results -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7316 Frère Sébastien Marie <semarie-koha@latrappe.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P1 - high |PATCH-Sent Patch Status|--- |Needs Signoff -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7316 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #6565|0 |1 is obsolete| | --- Comment #2 from Owen Leonard <oleonard@myacpl.org> 2011-12-05 19:36:03 UTC --- Created attachment 6583 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=6583 Signed-off patch -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7316 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch Status|Needs Signoff |Signed Off -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7316 Paul Poulain <paul.poulain@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|unspecified |rel_3_6 Patch Status|Signed Off |Patch Pushed --- Comment #3 from Paul Poulain <paul.poulain@biblibre.com> 2011-12-09 15:02:18 UTC --- patch pushed, please test -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7316 Jared Camins-Esakov <jcamins@cpbibliography.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable --- Comment #4 from Jared Camins-Esakov <jcamins@cpbibliography.com> --- Included in the 3.6 branch prior to 3.6.4. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org