Bugzilla – Attachment 40453 Details for
Bug 14423
Multiple XSS and XSRF issues in Staff Client
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 14423 : XSS bugs in catalogue search
Bug-14423--XSS-bugs-in-catalogue-search.patch (text/plain), 3.29 KB, created by
Jonathan Druart
on 2015-06-22 09:47:14 UTC
(
hide
)
Description:
Bug 14423 : XSS bugs in catalogue search
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2015-06-22 09:47:14 UTC
Size:
3.29 KB
patch
obsolete
>From 6592ef45cd4f9bd545180ef63fd905b87c7e4f43 Mon Sep 17 00:00:00 2001 >From: Chris <chris@bigballofwax.co.nz> >Date: Sun, 21 Jun 2015 09:01:32 +0000 >Subject: [PATCH] Bug 14423 : XSS bugs in catalogue search > >To test > >1/ hit a url like http://localhost:8081/cgi-bin/koha/catalogue/search.pl?limit=%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E >2/ Notice alert boxes >3/ Apply patch >4/ Reload url, no alerts >5/ Check search still works > >Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> >--- > koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt >index 9660bb4..4b1c94b 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt >@@ -259,7 +259,7 @@ var holdForPatron = function () { > <div id="breadcrumbs"> > <a href="/cgi-bin/koha/mainpage.pl">Home</a> > › <a href="/cgi-bin/koha/catalogue/search.pl">Catalog</a> >-› Search [% IF ( query_desc ) %]for '[% query_desc |html %]'[% END %][% IF ( limit_desc ) %] with limit(s): '[% limit_desc %]'[% END %] >+› Search [% IF ( query_desc ) %]for '[% query_desc |html %]'[% END %][% IF ( limit_desc ) %] with limit(s): '[% limit_desc | html %]'[% END %] > </div> > > <div id="doc3" class="yui-t1"> >@@ -304,7 +304,7 @@ var holdForPatron = function () { > <!-- RESORT END --> > </form> > <h3> >- [% total %] result(s) found [% IF ( query_desc ) %]for <span style="font-weight: bold;">'[% query_desc |html %]'</span>[% END %][% IF ( limit_desc ) %] with limit(s): <span style="font-weight: bold;">'[% limit_desc %]'</span>[% END %][% IF ( LibraryName ) %] in [% LibraryName %] Catalog[% END %].<br /> >+ [% total %] result(s) found [% IF ( query_desc ) %]for <span style="font-weight: bold;">'[% query_desc |html %]'</span>[% END %][% IF limit_desc %] with limit(s): <span style="font-weight: bold;">'[% limit_desc | html %]'</span>[% END %][% IF ( LibraryName ) %] in [% LibraryName %] Catalog[% END %].<br /> > </h3> > <div id="selection_ops" class="cartlist" style="display:none"> > <a href="#" onclick="selectAll(); return false;">Select all</a> >@@ -346,7 +346,7 @@ var holdForPatron = function () { > <h3>No results found</h3> > [% IF ( searchdesc ) %] > <p> >- No results match your search [% IF ( query_desc ) %]for <span style="font-weight: bold;">'[% query_desc |html %]'</span>[% END %][% IF ( limit_desc ) %] with limit(s): <span style="font-weight: bold;">'[% limit_desc %]'</span>[% END %][% IF ( LibraryName ) %] in [% LibraryName %] Catalog[% END %]. >+ No results match your search [% IF ( query_desc ) %]for <span style="font-weight: bold;">'[% query_desc |html %]'</span>[% END %][% IF ( limit_desc ) %] with limit(s): <span style="font-weight: bold;">'[% limit_desc | html %]'</span>[% END %][% IF ( LibraryName ) %] in [% LibraryName %] Catalog[% END %]. > </p> > [% ELSE %] > <p>You did not specify any search criteria.</p> >-- >2.1.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 14423
:
40383
|
40435
|
40436
|
40437
|
40438
|
40439
|
40440
|
40441
|
40449
|
40450
|
40451
|
40452
|
40453
|
40454
|
40455
|
40495
|
40496
|
40497
|
40498
|
40499
|
40500
|
40501
|
40503