Bug 14360: Unescaped variable causes alert
authorAleisha <aleishaamohia@hotmail.com>
Mon, 8 Jun 2015 02:30:23 +0000 (02:30 +0000)
committerFridolin Somers <fridolin.somers@biblibre.com>
Tue, 23 Jun 2015 09:37:29 +0000 (11:37 +0200)
commit47daa3e4a8f0e71585957ccffa1f7ed1ea62df6c
treee21e9690727fb655d5353bfe8847e1935904114d
parent3e6ad12ee87e8905f042091ae5d324524412f5d0
Bug 14360: Unescaped variable causes alert

Adding |html to [% resultsperpage %] to escape the variable and get rid of the alert.

To test:

1) Go to URL such as ...  /cgi-bin/koha/opac-authorities-home.pl?op=do_search&resultsperpage=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
2) Notice pop-up box with alert
3) Apply patch, refresh page
4) Notice alert is gone

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
(cherry picked from commit 9e920f7479df6d36db3e3450d6e6c2524fa9fe56)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
(cherry picked from commit ff0281d40ad9bcff563a595082b051dd4304ffc2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Conflicts:
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt