Bug 14423 : Multiple XSS vulnerabilities in serials-search

To test

1/ Hit a url like http://localhost:8081/cgi-bin/koha/serials/serials-search.pl?bookseller_filter=%22%22%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&searched=1&title_filter=
2/ Notice alert boxes
3/ Apply patch
4/ Reload, notice fixed

Repeat for
callnumber_filter
EAN_filter
ISSN_filter
publisher_filter
title_filter

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
(cherry picked from commit bab7a33c2d6b4774dd96af1d10f72620802e9b4e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Conflicts:
	koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt
index f570669..8fb55de 100644 (file)
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt
@@ -62,29 +62,29 @@
               <ol>
                 <li>
                   <label for="issn">ISSN:</label>
-                  <input type="text" id="issn" name="ISSN_filter" value="[% ISSN_filter %]" />
+                  <input type="text" id="issn" name="ISSN_filter" value="[% ISSN_filter | html %]" />
                 </li>
                 <li>
                   <label for="title">Title:</label>
-                  <input type="text" id="title" name="title_filter" value="[% title_filter %]" />
+                  <input type="text" id="title" name="title_filter" value="[% title_filter | html %]" />
                 </li>
                 [% IF ( marcflavour == "UNIMARC" ) %]
                 <li>
                   <label for="ean">EAN:</label>
-                  <input type="text" id="ean" name="EAN_filter" value="[% EAN_filter %]" />
+                  <input type="text" id="ean" name="EAN_filter" value="[% EAN_filter | html %]" />
                 </li>
                 [% END %]
                 <li>
                   <label for="callnumber">Call number:</label>
-                  <input type="text" id="callnumber" name="callnumber_filter" value="[% callnumber_filter %]" />
+                  <input type="text" id="callnumber" name="callnumber_filter" value="[% callnumber_filter | html %]" />
                 </li>
                 <li>
                   <label for="publisher">Publisher:</label>
-                  <input type="text" id="publisher" name="publisher_filter" value="[% publisher_filter %]" />
+                  <input type="text" id="publisher" name="publisher_filter" value="[% publisher_filter | html %]" />
                 </li>
                 <li>
                   <label for="bookseller">Vendor:</label>
-                  <input type="text" id="bookseller" name="bookseller_filter" value="[% bookseller_filter %]" />
+                  <input type="text" id="bookseller" name="bookseller_filter" value="[% bookseller_filter | html %]" />
                 </li>
                 <li>
                   <label for="branch">Library:</label>
@@ -278,7 +278,7 @@
                         </td>
                         <td>
                           [% UNLESS subscription.cannotedit %]
-                            <a href="/cgi-bin/koha/serials/serials-search.pl?subscriptionid=[% subscription.subscriptionid %]&amp;op=reopen&amp;routing=[% subscription.routing %]&amp;searched=1&amp;title_filter=[% title_filter %]&amp;ISSN_filter=[% ISSN_filter %]&amp;EAN_filter=[% EAN_filter %]&amp;published_filter=[% publisher_filter %]&amp;bookseller_filter=[% bookseller_filter %]&amp;branch_filter=[% branch_filter %]" id="reopensub">Reopen</a>
+                            <a href="/cgi-bin/koha/serials/serials-search.pl?subscriptionid=[% subscription.subscriptionid %]&amp;op=reopen&amp;routing=[% subscription.routing %]&amp;searched=1&amp;title_filter=[% title_filter | uri %]&amp;ISSN_filter=[% ISSN_filter | uri %]&amp;EAN_filter=[% EAN_filter | uri %]&amp;published_filter=[% publisher_filter | uri %]&amp;bookseller_filter=[% bookseller_filter | uri %]&amp;branch_filter=[% branch_filter | uri %]" id="reopensub">Reopen</a>
                           [% ELSE %]
                             Cannot edit
                           [% END %]
@@ -317,29 +317,29 @@
               <ol>
                 <li>
                   <label for="issn">ISSN:</label>
-                  <input type="text" id="issn" name="ISSN_filter" value="[% ISSN_filter %]" />
+                  <input type="text" id="issn" name="ISSN_filter" value="[% ISSN_filter | html %]" />
                 </li>
                 <li>
                   <label for="title">Title:</label>
-                  <input type="text" id="title" name="title_filter" value="[% title_filter %]" />
+                  <input type="text" id="title" name="title_filter" value="[% title_filter | html %]" />
                 </li>
                 [% IF ( marcflavour == "UNIMARC" ) %]
                 <li>
                   <label for="ean">EAN:</label>
-                  <input type="text" id="ean" name="EAN_filter" value="[% EAN_filter %]" />
+                  <input type="text" id="ean" name="EAN_filter" value="[% EAN_filter | html %]" />
                 </li>
                 [% END %]
                 <li>
                   <label for="callnumber">Call number:</label>
-                  <input type="text" id="callnumber" name="callnumber_filter" value="[% callnumber_filter %]" />
+                  <input type="text" id="callnumber" name="callnumber_filter" value="[% callnumber_filter | html %]" />
                 </li>
                 <li>
                   <label for="publisher">Publisher:</label>
-                  <input type="text" id="publisher" name="publisher_filter" value="[% publisher_filter %]" />
+                  <input type="text" id="publisher" name="publisher_filter" value="[% publisher_filter | html %]" />
                 </li>
                 <li>
                   <label for="bookseller">Vendor:</label>
-                  <input type="text" id="bookseller" name="bookseller_filter" value="[% bookseller_filter %]" />
+                  <input type="text" id="bookseller" name="bookseller_filter" value="[% bookseller_filter | html %]" />
                 </li>
                 <li>
                   <label for="branch">Library:</label>