From cdd75a5b31815c8831eca9686f431f4f0ce2c261 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Mon, 7 Aug 2017 22:17:14 +0530 Subject: [PATCH] Bug 19052 - XSS Flaws in - Invoice search page 1. Hit /cgi-bin/koha/acqui/invoices.pl 2. Enter Invoiceno, ISBN/EAN/ISSN, Title, Author, Publihser, Publication year search box. 3. Notice the iframe is executed. 4. Apply patch. 5. Reload page, and enter iframe again on Invoiceno, ISBN/EAN/ISSN, Title, Author, Publihser, Publication year search box. 6. Notice it is no longer executed. Signed-off-by: Chris Cormack --- .../prog/en/modules/acqui/invoices.tt | 24 +++++++++++----------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt index c296e9e8c6..de03894c0d 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt @@ -210,7 +210,7 @@ $(document).ready(function() {

Search was: