[koha-commits] main Koha release repository branch 3.20.x updated. v3.20.13-16-g947ddcb

[Git repo owner]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "main Koha release repository".

The branch, 3.20.x has been updated
       via  947ddcba9392d9565b03e911dd1d14e5e23e3bc1 (commit)
      from  4c3c2c8ec2dc748e8507ef4d6256b6187b0367c1 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 947ddcba9392d9565b03e911dd1d14e5e23e3bc1
Author: Jonathan Druart <jonathan.druart at bugs.koha-community.org>
Date:   Tue Aug 2 15:46:06 2016 +0100

    Bug 17029: Fix XSS in catalogue/*detail.pl
    
    Hit
      /cgi-bin/koha/catalogue/detail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
      /cgi-bin/koha/catalogue/ISBDdetail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
      /cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
      /cgi-bin/koha/catalogue/moredetail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
      /cgi-bin/koha/catalogue/labeledMARCdetail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
    
    => Without this patch you will see the alert
    => With this patch, no more alert
    
    Signed-off-by: Chris Cormack <chris at bigballofwax.co.nz>
    
    Signed-off-by: Katrin Fischer <katrin.fischer.83 at web.de>
    Signed-off-by: Chris Cormack <chris at bigballofwax.co.nz>

-----------------------------------------------------------------------

Summary of changes:
 catalogue/ISBDdetail.pl        |    2 ++
 catalogue/MARCdetail.pl        |    4 +++-
 catalogue/detail.pl            |    2 ++
 catalogue/labeledMARCdetail.pl |    2 ++
 catalogue/moredetail.pl        |    2 ++
 5 files changed, 11 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
main Koha release repository