From f77c3d014fdda5890d7f7ff1d9d14095dc2377ce Mon Sep 17 00:00:00 2001
From: Bill Erickson <berick@esilibrary.com>
Date: Wed, 17 Aug 2011 15:28:53 -0400
Subject: [PATCH] TPac: more aggressive dynamic output filtering

Making heavier user of html/uri filters to prevent accidental or
malicious rendering of html from dynamic data.  More to follow.

Signed-off-by: Bill Erickson <berick@esilibrary.com>
---
 Open-ILS/web/templates/default/opac/parts/anon_list.tt2   |  6 +++---
 .../templates/default/opac/parts/coded_value_selector.tt2 |  2 +-
 .../web/templates/default/opac/parts/org_selector.tt2     |  4 ++--
 Open-ILS/web/templates/default/opac/parts/place_hold.tt2  | 15 +++++++--------
 .../web/templates/default/opac/parts/qtype_selector.tt2   |  4 ++--
 Open-ILS/web/templates/default/opac/parts/topnav.tt2      |  2 +-
 Open-ILS/web/templates/default/opac/results.tt2           |  8 +++++---
 7 files changed, 21 insertions(+), 20 deletions(-)

diff --git a/Open-ILS/web/templates/default/opac/parts/anon_list.tt2 b/Open-ILS/web/templates/default/opac/parts/anon_list.tt2
index 19a7440320..6f91af7b00 100644
--- a/Open-ILS/web/templates/default/opac/parts/anon_list.tt2
+++ b/Open-ILS/web/templates/default/opac/parts/anon_list.tt2
@@ -36,7 +36,7 @@
                                 [% IF ctx.user AND ctx.bookbags.size %]
                                 <optgroup label="Move selected items to">
                                     [% FOR bbag IN ctx.bookbags %]]
-                                    <option value="[% bbag.id %]" class="opac-auto-179-inner-option">[% bbag.name %]</option>
+                                    <option value="[% bbag.id %]" class="opac-auto-179-inner-option">[% bbag.name | html %]</option>
                                     [% END %]
                                 </optgroup>
                                 [% END %]
@@ -53,8 +53,8 @@
                         <td class="opac-auto-097b" style="padding-left: 10px;">
                             <input type="checkbox" name="record" value="[% item %]" />
                         </td>
-                        <td class="opac-auto-097b" style="padding-left: 5px;">[% attrs.title %]</td>
-                        <td class="opac-auto-097b" style="padding-left: 5px;">[% attrs.author %]</td>
+                        <td class="opac-auto-097b" style="padding-left: 5px;">[% attrs.title | html %]</td>
+                        <td class="opac-auto-097b" style="padding-left: 5px;">[% attrs.author | html %]</td>
                     </tr>
                     [% END %]
                 </tbody>
diff --git a/Open-ILS/web/templates/default/opac/parts/coded_value_selector.tt2 b/Open-ILS/web/templates/default/opac/parts/coded_value_selector.tt2
index ad46d794f5..33469fe558 100644
--- a/Open-ILS/web/templates/default/opac/parts/coded_value_selector.tt2
+++ b/Open-ILS/web/templates/default/opac/parts/coded_value_selector.tt2
@@ -22,7 +22,7 @@
     <option value=''>[% none_label ? none_label : l('-- Any --') %]</option>
 [% END %]
 [% FOR o IN all_values %]
-    <option value='[% o.code %]'[% values.grep('^' _ o.code _ '$').size ? ' selected="selected"' : '' %]>[% o.value %]</option>
+    <option value='[% o.code | uri %]'[% values.grep('^' _ o.code _ '$').size ? ' selected="selected"' : '' %]>[% o.value | html %]</option>
 [%  END -%]
 </select>
 
diff --git a/Open-ILS/web/templates/default/opac/parts/org_selector.tt2 b/Open-ILS/web/templates/default/opac/parts/org_selector.tt2
index 52500f0518..1485679510 100644
--- a/Open-ILS/web/templates/default/opac/parts/org_selector.tt2
+++ b/Open-ILS/web/templates/default/opac/parts/org_selector.tt2
@@ -8,11 +8,11 @@
             selected = 'selected="selected"';
         END;
 %]
-        <option value='[% walker.id %]' [% selected %] [% disabled %]>
+        <option value='[% walker.id | uri %]' [% selected %] [% disabled %]>
             [%
                 pad = walker.ou_type.depth * 2;
                 FOR idx IN [0..pad]; '&nbsp;'; END;
-                walker.name;
+                walker.name | html;
             %]
         </option>
         [%  FOR child IN walker.children;
diff --git a/Open-ILS/web/templates/default/opac/parts/place_hold.tt2 b/Open-ILS/web/templates/default/opac/parts/place_hold.tt2
index 861a987a5b..903cbb65a8 100644
--- a/Open-ILS/web/templates/default/opac/parts/place_hold.tt2
+++ b/Open-ILS/web/templates/default/opac/parts/place_hold.tt2
@@ -15,7 +15,7 @@
             [% ELSIF ctx.hold_failed_event || ctx.hold_local_alert %]
         <div>
             <strong>[% l('Problem:') %]</strong>
-            <span title="[% ctx.hold_failed_event.textcode %]">
+            <span title="[% ctx.hold_failed_event.textcode | html %]">
                 <em>[%
                         fail_part_key = ctx.hold_failed_event.payload.fail_part;
                         event_key = ctx.hold_failed_event.textcode;
@@ -32,8 +32,7 @@
             </span>
 
             [% IF ctx.hold_copy_available %]<p>
-            [% l('Find a copy in the shelving location, "[_1]."',
-                ctx.hold_copy_available.location) %]
+            [%  l('Find a copy in the shelving location, "[_1]."', locname) | html %]
             </p>[% END %]
 
             [% IF ctx.could_override || ctx.hold_local_alert %]
@@ -45,7 +44,7 @@
             <form method="POST">
                 <input type="hidden" type="name" name="override" value="1" />
                 [% FOR k IN ctx.orig_params.keys %]
-                <input type="hidden" name="[% k %]" value="[% ctx.orig_params.$k | html %]" />
+                <input type="hidden" name="[% k %]" value="[% ctx.orig_params.$k | uri %]" />
                 [% END %]
                 <input type="image" name="submit" value="submit" title="[% l('Submit') %]"
                     alt="[% l('Submit') %]" src="[% ctx.media_prefix %]/images/btnSubmit.png" />
@@ -83,20 +82,20 @@
                 <label for="hold_usr_is_requestor_not">
                     [% l("Place hold for patron by barcode:") %]
                 </label>
-                <input type="text" name="hold_usr" id="hold_usr_input" value="[% ctx.patron_recipient.card.barcode %]" /><br />[%# XXX multi-barcode users? %]
+                <input type="text" name="hold_usr" id="hold_usr_input" value="[% ctx.patron_recipient.card.barcode | html %]" /><br />[%# XXX multi-barcode users? %]
                 <span>
                     <input type="radio" id="hold_usr_is_requestor"
                         onchange="staff_hold_usr_input_disabler(this);"
                         name="hold_usr_is_requestor" value="1" />
                     <label for="hold_usr_is_requestor">
-                        [% l("Place this hold for me ([_1] [_2])",
-                        ctx.user.first_given_name, ctx.user.family_name) %]
+                        [% l("Place this hold for me ([_1] [_2])", ctx.user.first_given_name, ctx.user.family_name) | html %]
                     </label>
                 </span>
             </p>
             [% END %]
             <p>
-                [% | l(attrs.title, ctx.get_aou(ctx.default_pickup_lib).name) %]
+                [%  title = attrs.title | html; libname = ctx.get_aou(ctx.default_pickup_lib).name | html %]
+                [% | l(title, libname) %]
                 You would like to place a hold on <strong><q>[_1]</q></strong>.<br />
                 If this is correct, confirm your pickup location and click <strong>SUBMIT</strong>.
                 [% END %]
diff --git a/Open-ILS/web/templates/default/opac/parts/qtype_selector.tt2 b/Open-ILS/web/templates/default/opac/parts/qtype_selector.tt2
index f79de8a29e..4b91a477bf 100644
--- a/Open-ILS/web/templates/default/opac/parts/qtype_selector.tt2
+++ b/Open-ILS/web/templates/default/opac/parts/qtype_selector.tt2
@@ -9,8 +9,8 @@
 <select name="qtype">
     [%  query_type = query_type || CGI.param('qtype');
         FOR qt IN query_types -%]
-    <option value='[% qt.value %]'[%
+    <option value='[% qt.value | uri %]'[%
         query_type == qt.value ? ' selected="selected"' : ''
-    %]>[% qt.label %]</option>
+    %]>[% qt.label | html %]</option>
     [% END -%]
 </select>
diff --git a/Open-ILS/web/templates/default/opac/parts/topnav.tt2 b/Open-ILS/web/templates/default/opac/parts/topnav.tt2
index 5c01e7ee6b..5aaa7b8442 100644
--- a/Open-ILS/web/templates/default/opac/parts/topnav.tt2
+++ b/Open-ILS/web/templates/default/opac/parts/topnav.tt2
@@ -22,7 +22,7 @@
                         </td>
                         <td id="dash_corner_mid1a">
                             <span id="dash_user">
-                                [%  l('[_1] [_2]', ctx.user.first_given_name, ctx.user.family_name) %]
+                                [%  l('[_1] [_2]', ctx.user.first_given_name, ctx.user.family_name) | html %]
                             </span>
                         </td>
                         <td id="dash_corner_mid1b">
diff --git a/Open-ILS/web/templates/default/opac/results.tt2 b/Open-ILS/web/templates/default/opac/results.tt2
index 5c0a620d52..a49b2ec03d 100644
--- a/Open-ILS/web/templates/default/opac/results.tt2
+++ b/Open-ILS/web/templates/default/opac/results.tt2
@@ -7,10 +7,12 @@
     IF is_advanced || is_special;
         ctx.page_title = l("Search Results");
     ELSE;
-        ctx.page_title = l("Search Results: ") _ CGI.param('query') | html_entity;
+        ctx.page_title = l("Search Results: ") _ CGI.param('query') | html;
     END;
 
-    page = CGI.param('page') || 0;
+    page = CGI.param('page');
+    page = page.match('^\d+$') ? page : 0; # verify page is a sane value
+
     page_count = ctx.page_size == 0 ? 1 : POSIX.ceil(ctx.hit_count / ctx.page_size);
 %]
     <form action="[% ctx.opac_root %]/results" method="GET">
@@ -44,7 +46,7 @@
                 [% END %]
                 <div class="results_header_div"></div>
                 [% UNLESS is_advanced || is_special %]
-                    <div class="results_header_lbl">Sort by</div>
+                    <div class="results_header_lbl">[% l('Sort by') %]</div>
                     [% INCLUDE "default/opac/parts/filtersort.tt2" value=CGI.param('sort') %]
                     <div class="results_header_div"></div>
 
-- 
2.11.0