From 3867a32c1e7bb82e1de11da6e4f31c8f2378d200 Mon Sep 17 00:00:00 2001 From: Galen Charlton Date: Wed, 24 May 2017 12:26:45 -0400 Subject: [PATCH] update 2.12.2 release notes Signed-off-by: Galen Charlton --- docs/RELEASE_NOTES_2_12.adoc | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/docs/RELEASE_NOTES_2_12.adoc b/docs/RELEASE_NOTES_2_12.adoc index e5242a9955..db2ed72ae6 100644 --- a/docs/RELEASE_NOTES_2_12.adoc +++ b/docs/RELEASE_NOTES_2_12.adoc @@ -6,7 +6,21 @@ Evergreen 2.12 Release Notes Evergreen 2.12.2 ---------------- -This release contains several bug fixes improving on Evergreen 2.12.2. +This release is a security release that also contains several other bug +fixes improving on Evergreen 2.12.1. + +Security Issue: XSS Vulnerability in Public Catalog +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +This release fixes several cross-site scripting (XSS) vulnerabilities +in the public catalog. When upgrading, Evergreen administrators should +review whether any of the following templates have been customized +or overridden. If so, either the template should be replaced with the +stock version or the XSS fix (which entails adding the `| html` filter +in several places) applied to the customized version. + +* `Open-ILS/src/templates/opac/parts/locale_picker.tt2` +* `Open-ILS/src/templates/opac/parts/login/form.tt2` +* `Open-ILS/src/templates/opac/parts/searchbar.tt2` Upgrade Notes ~~~~~~~~~~~~~ -- 2.11.0