From 95d73451efba7de6eb0d820bc781364133ba88f9 Mon Sep 17 00:00:00 2001
From: Dan Scott <dscott@laurentian.ca>
Date: Wed, 21 Mar 2018 22:08:35 +0100
Subject: [PATCH] LP1757526 Escape displayed catalogue data

Content in content fields (5xx) as well as for the names of locations in copy
count alt text was not being properly escaped, allowing for the possibility of
executing arbitrary JavaScript in the case of a malicious catalogue record
(whether edited in the system, or imported)

Signed-off-by: Dan Scott <dscott@laurentian.ca>
Signed-off-by: Chris Sharp <csharp@georgialibraries.org>
Signed-off-by: Galen Charlton <gmc@equinoxinitiative.org>
---
 Open-ILS/src/templates/opac/parts/record/contents.tt2    | 3 +--
 Open-ILS/src/templates/opac/parts/record/copy_counts.tt2 | 4 ++--
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/Open-ILS/src/templates/opac/parts/record/contents.tt2 b/Open-ILS/src/templates/opac/parts/record/contents.tt2
index 29fc33b4cd..50ae616288 100644
--- a/Open-ILS/src/templates/opac/parts/record/contents.tt2
+++ b/Open-ILS/src/templates/opac/parts/record/contents.tt2
@@ -170,8 +170,7 @@ BLOCK render_contents;
             all_content.push(subfield.textContent);
         END;
         total_contents = all_content.join(" ").replace('\s+$', '');
-        %] [% total_contents;
-        IF total_contents.size; "<br/>"; END;
+        %] [% "<div class='content_field'>"; total_contents | html ; "</div>";
         FOREACH link880 IN graphics;
             '<div class="graphic880"' _ link880.dir _ '>';
             link880.value | html;
diff --git a/Open-ILS/src/templates/opac/parts/record/copy_counts.tt2 b/Open-ILS/src/templates/opac/parts/record/copy_counts.tt2
index eee85e8f09..e6e783f244 100644
--- a/Open-ILS/src/templates/opac/parts/record/copy_counts.tt2
+++ b/Open-ILS/src/templates/opac/parts/record/copy_counts.tt2
@@ -23,7 +23,7 @@
     [%- this_depth = ctx.get_aou(ou_id).ou_type.depth;
         IF ou_count > 0 && this_depth != ctx.copy_depth %]
     <a href="[% mkurl('', {copy_depth => this_depth}, ['copy_offset']); %]"
-       title="[% l('Show copies at [_1]', ou_name); %]">
+       title="[% l('Show copies at [_1]', ou_name) | html; %]">
        [%- l('(Show)'); %]</a>
     [%- END; %]
     </li>
@@ -43,7 +43,7 @@
             attrs.plib_copy_counts.$depth.count,
             ou_name) | html
     %] <a href="[% mkurl('', {locg => ou_id}, ['copy_offset']); %]"
-       title="[% l('Show copies at [_1]', ou_name); %]">[%
+       title="[% l('Show copies at [_1]', ou_name) | html; %]">[%
        l('(Show preferred library)');
     %]</a></li>
     [%- END %]
-- 
2.11.0