Correct missing escaping of template variable

[asmecher]

The $authors variable in templates/frontend/pages/search.tpl is not escaped. This permits a reflected (non-persistent) XSS attack.

Instructions to patch are here: #3785 (comment)
See also the notes there about affected theme plugins.

Affects OJS 3.0.0 to 3.1.1-1 (inclusive).

https://nvd.nist.gov/vuln/detail/CVE-2018-12229
Thanks to Metamorfosec for discovery & reporting.

[asmecher]

This issue applies to OJS between 3.0.0 and 3.1.1-1 and the themes noted below, and can be corrected by applying this patch: https://github.com/pkp/ojs/commit/ba66a117835a8bbbed4fb12d3c35734e996a211f.diff

For example, on most Linux systems this should work. Run it inside the OJS installation directory.

wget -q -O - https://github.com/pkp/ojs/commit/ba66a117835a8bbbed4fb12d3c35734e996a211f.diff | patch -p1

You should see the following output:

patching file templates/frontend/pages/search.tpl

The issue is corrected in OJS 3.1.1-2 and newer.

If you're using checkouts from git, all stable branches (e.g. ojs-stable-3_1_1) have been patched.

If you are using the Bootstrap theme plugin, version 1.1.4 corrects a similar issue. Users of older versions than 1.1.4 should update.

If you are using the Health Sciences theme plugin, version 1.0.1 corrects a similar issue. Users of 1.0.0 should update.