From: Katrin Fischer <Katrin.Fischer.83@web.de>
Date: Mon, 15 Oct 2012 07:07:50 +0000 (+0200)
Subject: Bug 3652: [SIGNED-OFF] XSS fixes - follow up
X-Git-Url: http://git.rot13.org/?a=commitdiff_plain;h=ac66d224add7324d08b0bdf86d1574e401280e41;p=koha.git

Bug 3652: [SIGNED-OFF] XSS fixes - follow up

Fixes a typo in the html filter that causes a problem when using the
paging in the OPAC result lists.

(forgot to commit my change when testing the original XSS patches)

Signed-off-by: Magnus Enger <magnus@enger.priv.no>
I triggered the error with this query string:
/cgi-bin/koha/opac-search.pl?idx=kw&q=o'reilly&offset=40&sort_by=author_az
After applying the patch the error is gone.

Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
---

diff --git a/koha-tmpl/opac-tmpl/prog/en/includes/page-numbers.inc b/koha-tmpl/opac-tmpl/prog/en/includes/page-numbers.inc
index ff9b11c55c..935d943970 100644
--- a/koha-tmpl/opac-tmpl/prog/en/includes/page-numbers.inc
+++ b/koha-tmpl/opac-tmpl/prog/en/includes/page-numbers.inc
@@ -1,6 +1,6 @@
 [% IF ( PAGE_NUMBERS ) %]<div class="pages">
     <!-- Row of numbers corresponding to search result pages -->
-        [% IF ( previous_page_offset ) %]<a class="nav" href="/cgi-bin/koha/opac-search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;offset=[% previous_page_offset %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |htm l%][% END %]">&lt;&lt; Previous</a>[% END %]
+        [% IF ( previous_page_offset ) %]<a class="nav" href="/cgi-bin/koha/opac-search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;offset=[% previous_page_offset %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |html %][% END %]">&lt;&lt; Previous</a>[% END %]
     [% FOREACH PAGE_NUMBER IN PAGE_NUMBERS %][% IF ( PAGE_NUMBER.highlight ) %]<span class="current">[% PAGE_NUMBER.pg %]</span>[% ELSE %]        <a class="nav" href="/cgi-bin/koha/opac-search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;offset=[% PAGE_NUMBER.offset %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |html%][% END %]">[% PAGE_NUMBER.pg %]</a>[% END %]
     [% END %]
         [% IF ( next_page_offset ) %]<a class="nav" href="/cgi-bin/koha/opac-search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;offset=[% next_page_offset %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |html %][% END %]">Next &gt;&gt;</a>[% END %] </div>[% END %]