[Bug 8973] New: HTML and URL escape missing in OPAC templates
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8973 Priority: P5 - low Change sponsored?: --- Bug ID: 8973 Assignee: oleonard@myacpl.org Summary: HTML and URL escape missing in OPAC templates Severity: normal Classification: Unclassified OS: All Reporter: fridolyn.somers@biblibre.com Hardware: All Status: NEW Version: master Component: OPAC Product: Koha In a few templates variables, the title or author are not html or url escaped. This causes crash of email sharing for example (in opac-details.tt) when title contains a ". -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8973 Fridolyn SOMERS <fridolyn.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff Assignee|oleonard@myacpl.org |fridolyn.somers@biblibre.co | |m --- Comment #1 from Fridolyn SOMERS <fridolyn.somers@biblibre.com> --- Created attachment 13070 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=13070&action=edit Proposed patch -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8973 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8973 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #13070|0 |1 is obsolete| | --- Comment #2 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 13098 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=13098&action=edit [SIGNED-OFF] Bug 8973: HTML and URL escape missing in OPAC templates Signed-off-by: Owen Leonard <oleonard@myacpl.org> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8973 Paul Poulain <paul.poulain@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA CC| |paul.poulain@biblibre.com --- Comment #3 from Paul Poulain <paul.poulain@biblibre.com> --- QA comment: * 3 lines patch that fix a bug that could even be exploited for XSS injection * passes koha-qa.pl * no string change passed QA -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8973 Paul Poulain <paul.poulain@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master Version|master |rel_3_8 QA Contact| |paul.poulain@biblibre.com --- Comment #4 from Paul Poulain <paul.poulain@biblibre.com> --- Patch pushed to master -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8973 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable CC| |chris@bigballofwax.co.nz --- Comment #5 from Chris Cormack <chris@bigballofwax.co.nz> --- Pushed to 3.8.x will be in 3.8.7 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8973 Liz Rea (CatalystIT) <liz@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Stable |RESOLVED CC| |liz@catalyst.net.nz Resolution|--- |FIXED --- Comment #6 from Liz Rea (CatalystIT) <liz@catalyst.net.nz> --- This does not apply for 3.6.x, please send a 3.6.x patch if it is needed. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8973 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|FIXED |--- -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8973 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |ASSIGNED Version|3.8 |3.6 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8973 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8973 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #13098|0 |1 is obsolete| | --- Comment #7 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 13514 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=13514&action=edit Bug 8973 [3.6.x] HTML and URL escape missing in OPAC templates Adding HTML filter to some template variables which require them. This patch is for 3.6.x, based on Fridolyn SOMERS patch for master. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8973 --- Comment #8 from Fridolyn SOMERS <fridolyn.somers@biblibre.com> --- I wanted to signoff 3.6 patch, but patch is already pushed in 3.6.x : http://git.koha-community.org/gitweb/?p=koha.git;a=commit;h=b28598369ac95a97... -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8973 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8973 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org