From bugzilla-daemon@wilbur.katipo.co.nz Mon Feb  3 19:56:38 2003
From: bugzilla-daemon@wilbur.katipo.co.nz
To: koha-devel@lists.koha-community.org
Subject: [Koha-devel] [Bug 196] New: user input not checked for HTML tags
Date: Mon, 03 Feb 2003 19:57:04 +0000
Message-ID: <20030204035541.5867.qmail@wilbur.katipo.co.nz>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============3565177303575718219=="

--===============3565177303575718219==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=196

           Summary: user input not checked for HTML tags
           Product: Koha
           Version: CVS
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: normal
          Priority: P2
         Component: OPAC
        AssignedTo: chris@katipo.co.nz
        ReportedBy: a.c.li@ieee.org
         QAContact: koha-devel@lists.sourceforge.net


(Note: Component really should be All, but there is no All for Component )-:

A user can search for <HR>, and Koha will happily display the horizontal rule.
If the user enters something nasty like <SCRIPT>, bad things may happen.

(Entity names, on the other hands, may need to be handled; e.g., if the OPAC
uses iso-8859-1 but the library contains some Chinese books, the user might
enter some Chinese, which will get turned into numerical character entities by
the time the CGI gets the input.)

This should probably be considered a security bug.



------- You are receiving this mail because: -------
You are the QA contact for the bug, or are watching the QA contact.


--===============3565177303575718219==--