gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 26102: [19.11] Prevent XSS when To.json is used: authorities/authorities.tt 

Check that mandatory tags and subfields are correctly required when
editing an authority record.

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
This commit is contained in:
Owen Leonard 2020-08-11 12:34:18 +00:00 committed by Wainui Witika-Park
parent 383e7b8b9e
commit b4dbedbcd4
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt
View File

@ -1,5 +1,6 @@
[% USE raw %]
[% USE Asset %]
[% USE To %]
[% INCLUDE 'doc-head-open.inc' %]
<title>Koha &rsaquo; Authorities &rsaquo; [% IF ( authid ) %]Modify authority #[% authid | html %] ([% authtypetext | html %])[% ELSE %]Adding authority ([% authtypetext | html %])[% END %]</title>
[% INCLUDE 'doc-head-close.inc' %]
@ -69,7 +70,7 @@ function AreMandatoriesNotOk(){
[% FOREACH subfield_loo IN innerloo.subfield_loop %]
[% IF ( subfield_loo.mandatory ) %]mandatories.push("[% subfield_loo.id | html %]");
tab.push("[% BIG_LOO.number | html %]");
label.push("[% subfield_loo.marc_lib | $raw |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]");
label.push("[% To.json(subfield_loo.marc_lib) | html %]");
[% END %]
[% END %]
[% END %]