Correct missing escaping in searchResults.tpl

[asmecher]

The searchQuery template variable presents user-supplied information without proper escaping. This permits a reflected (non-persistent) XSS attack.

Instructions to patch are here: #3805 (comment)

Affects OMP between 1.2.0 and 3.1.1-2 (inclusive).

https://nvd.nist.gov/vuln/detail/CVE-2018-12588
Thanks to Metamorfosec for discovery & reporting.

[asmecher]

This can be corrected for OMP between 1.2.0 and 3.1.1-1 (inclusive) by applying this patch: https://github.com/pkp/omp/commit/ebf3a701708112f4973d02f26a0b1d746dcd4970.diff

OMP 1.2.0 to 3.1.1-2 additionally need the following patch:
pkp/omp@15ab902

For example, on most Linux systems this should work. Run it inside the OJS installation directory.

wget -q -O - https://github.com/pkp/omp/commit/ebf3a701708112f4973d02f26a0b1d746dcd4970.diff | patch -p1
wget -q -O - https://github.com/pkp/omp/commit/15ab9027bfdfbf742616a62a2bbafec3d217dbeb.diff | patch -p1

You should see the following output for each of the two commands:

patching file templates/frontend/pages/searchResults.tpl

The issue is corrected in OMP 3.1.1-3 and newer.

If you're using checkouts from git, all stable branches (e.g. omp-stable-3_1_1) have been patched.