Bug 14418: XSS flaw in opac-shelves.pl

[srvgit] / koha-tmpl / opac-tmpl / bootstrap / en / modules / opac-shelves.tt

diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
index ef2a32b..b586ac1 100644 (file)
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
@@ -43,7 +43,7 @@
 
 [% INCLUDE 'masthead.inc' %]
 <div class="main">
-    <ul class="breadcrumb">
+    <ul class="breadcrumb noprint">
         <li><a href="/cgi-bin/koha/opac-main.pl">Home</a> <span class="divider">&rsaquo;</span></li>
         [% IF ( loggedinusername ) %]
             <li><a href="/cgi-bin/koha/opac-user.pl">[% FOREACH USER_INF IN USER_INFO %][% USER_INF.title %] [% USER_INF.firstname %] [% USER_INF.surname %][% END %]</a> <span class="divider">&rsaquo;</span></li>
@@ -91,7 +91,7 @@
 
     <div class="container-fluid">
         <div class="row-fluid">
-            [% IF ( OpacNav||loggedinusername ) %]
+            [% IF ( OpacNav||loggedinusername ) && !print %]
                 <div class="span2">
                     <div id="navigation">
                         [% INCLUDE 'navigation.inc' IsPatronPage=1 %]
@@ -130,10 +130,10 @@
                               <div class="alert">A record matching barcode <b>[% paramsloo.duplicatebiblio %]</b> has already been added.</div>
                             [% END %]
                             [% IF ( paramsloo.delete_ok ) %]
-                              <div class="alert alert-info">List [% paramsloo.delete_ok %] Deleted.</div>
+                              <div class="alert alert-info">List [% paramsloo.delete_ok |html %] Deleted.</div>
                             [% END %]
                             [% IF ( paramsloo.delete_fail ) %]
-                              <div class="alert alert-info">ERROR: Database error. Delete (list number [% paramsloo.delete_fail %]) failed.</div>
+                              <div class="alert alert-info">ERROR: Database error. Delete (list number [% paramsloo.delete_fail |html %]) failed.</div>
                             [% END %]
                             [% IF ( paramsloo.unrecognized ) %]
                               <div class="alert alert-info">ERROR: List number [% paramsloo.unrecognized %] unrecognized.</div>
@@ -153,8 +153,8 @@
                     [% IF ( viewshelf ) %]<!--  Viewing a particular shelf -->
                         <h3>
                             [% shelfname |html %]
-                            <a href="[% OPACBaseURL %]/cgi-bin/koha/opac-shelves.pl?rss=1&amp;viewshelf=[% shelfnumber | html %]" class="rss-list-link noprint">
-                                <img src="[% interface %]/[% theme %]/images/feed-icon-16x16.png" alt="Subscribe to this search" title="Subscribe to this search" border="0" class="rsssearchicon"/>
+                            <a href="[% OPACBaseURL %]/cgi-bin/koha/opac-shelves.pl?rss=1&amp;viewshelf=[% shelfnumber %]" class="rss-list-link noprint">
+                                <img src="[% interface %]/[% theme %]/images/feed-icon-16x16.png" alt="Subscribe to this list" title="Subscribe to this list" border="0" class="rsssearchicon"/>
                             </a>
                         </h3>
 
@@ -168,7 +168,7 @@
                                         <span class="sendlist"><a href="/cgi-bin/koha/opac-sendshelf.pl?shelfid=[% shelfnumber | html %]" class="send" onclick="open('/cgi-bin/koha/opac-sendshelf.pl?shelfid=[% shelfnumber | html %]','win_form','scrollbars=no,resizable=no,height=300,width=450,top=50,left=100'); return false; ">Send list</a></span>
                                     [% END %]
 
-                                    <a class="print-small" href="/cgi-bin/koha/opac-shelves.pl" onclick="print(); return false;">Print list</a>
+                                    <a class="print-small" target="_blank" href="/cgi-bin/koha/opac-shelves.pl?viewshelf=[% shelfnumber %]&sort=[% sort %]&direction=[% direction |uri %]&print=1">Print list</a>
 
                                     [% IF ( manageshelf ) %]
                                         <span class="sep">|</span>
@@ -248,7 +248,7 @@
 
                             </div> <!-- / #toolbar -->
 
-                            <div id="selections-toolbar" class="toolbar">
+                            <div id="selections-toolbar" class="toolbar noprint">
                                 <span class="checkall"></span> <span class="clearall"></span> <span class="sep">|</span>
                                 <span class="links">
                                     <span id="selections">Select titles to: </span>
@@ -1023,6 +1023,11 @@ $(function() {
     [% IF OPACLocalCoverImages %]KOHA.LocalCover.GetCoverFromBibnumber(false);[% END %]
     [% IF ( GoogleJackets ) %]KOHA.Google.GetCoverFromIsbn();[% END %]
     $('#sort-submit').hide();
+
+    [% IF print %]
+        window.print();
+        setTimeout('window.close()', 1);
+    [% END %]
 }); // document.ready
 
 function Check(f) {