[Koha] Potential XSS attack vector in opac

[Chris Cormack]

Hi Elaine 

It's in the 3.18.01 release notes
http://koha-community.org/koha-3-18-01-security-release/

You won't be able to see it in bugzilla the bug is still private until a 3.16.x release is done but you can cherry pick the code from the 3.18.x branch in git 

Chris 

On 11 December 2014 6:33:33 am NZDT, Elaine Bradtke <eb at efdss.org> wrote:
>Could someone let us know what bug number this is?
>Thanks
>
>
>On Wed, Dec 10, 2014 at 5:01 AM, Robin Sheat <robin at catalyst.net.nz>
>wrote:
>
>> Chris Cormack schreef op wo 10-12-2014 om 12:46 [+1300]:
>> > I have reported the bug, and I am just uploading a couple of
>patches,
>> > (one for master/3.18 which is bootstrap) and one for 3.16 which has
>> > the change for bootstrap and prog
>>
>> Packages for 3.18.01 have been released to the 'squeeze' repository.
>>
>> The 'oldstable' repository will get 3.16 when an update for that have
>> been released. Note that it currently contains 3.14.11, so this will
>> also be an upgrade for that (which I'd rather didn't happen, but I
>was
>> waiting for 3.16.05 anyway before updating it.)
>>
>> I expect this to happen tomorrow, though I'll be conferencing then so
>I
>> can't promise exactly when it'll happen.
>>
>> --
>> Robin Sheat
>> Catalyst IT Ltd.
>> ✆ +64 4 803 2204
>> GPG: 5FA7 4B49 1E4D CAA4 4C38  8505 77F5 B724 F871 3BDF
>>
>> _______________________________________________
>> Koha mailing list  http://koha-community.org
>> Koha at lists.katipo.co.nz
>> http://lists.katipo.co.nz/mailman/listinfo/koha
>>
>
>
>
>-- 
>Elaine Bradtke
>Data Wrangler
>VWML
>English Folk Dance and Song Society | http://www.efdss.org
>Cecil Sharp House, 2 Regent's Park Road, London NW1 7AY
>Tel    +44 (0) 20 7485 2206 (This number is for the English Folk Dance
>and
>Song Society in London, England. If you wish to phone me personally,
>send
>an e-mail first. I work off site)
>--------------------------------------------------------------------------
>Registered Company No. 297142
>Charity Registered in England and Wales No. 305999
>---------------------------------------------------------------------------
>"Writing about music is like dancing about architecture"
>--Elvis Costello (Musician magazine No. 60 (October 1983), p. 52)
>_______________________________________________
>Koha mailing list  http://koha-community.org
>Koha at lists.katipo.co.nz
>http://lists.katipo.co.nz/mailman/listinfo/koha

-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.