Signed-off-by: Jane Sandberg <email address hidden>
18afce5...
by
Galen Charlton <email address hidden>
LP#1930933: fix issue with over-escaping in search results title attributes
This patch fixes an issue where a record with a title containing the
word "hidden" can have its title, ironically enough, not show up
on public catalog search results.
To test
-------
[1] Create an OPAC-visible record whose 245 is something like:
=245 04$aThe hidden one <script>alert('title!')</script>
[2] Search for the record in both the TPAC and Bootstrap skin. Note
that the title isn't displayed.
[3] Apply the patch and repeat step 2. This time, the full title
should be displayed.
[4] Verify that the OPAC does not display an alert box.
Signed-off-by: Galen Charlton <email address hidden>
Signed-off-by: Jason Stephenson <email address hidden>
Signed-off-by: Jeff Davis <email address hidden>
LP#1923225: have search highlighting stored procedure do HTML-escaping
This patch builds on the previous work to have the stored procedures
that produced highlighted and unhighlighted versions of display
attributes HTML-escape the source values, then adjusts the TPAC
and Bootstrap templates to avoid double-escaping.
