From e84be049dbe04f5776dd8671013834a2a6913115 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Mon, 14 Aug 2017 22:27:03 +0530 Subject: [PATCH] Bug 19086 Stored XSS in readingrec.pl 1. Hit /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx xx is a borrowernumber 2. Notice java script is execute. 3. Apply patch. 4. Reload page, and hit the page again /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx xx is a borrowernumber 5. Notice it is no longer executed. --- members/readingrec.pl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/members/readingrec.pl b/members/readingrec.pl index b0b563c..5a26851 100755 --- a/members/readingrec.pl +++ b/members/readingrec.pl @@ -24,7 +24,7 @@ use strict; use warnings; use CGI qw ( -utf8 ); - +use HTML::Entities; use C4::Auth; use C4::Output; use C4::Members; @@ -59,7 +59,7 @@ if ($input->param('cardnumber')) { $borrowernumber = $data->{'borrowernumber'}; # we must define this as it is used to retrieve other data about the patron } if ($input->param('borrowernumber')) { - $borrowernumber = $input->param('borrowernumber'); + $borrowernumber = HTML::Entities::encode($input->param('borrowernumber')); $patron = Koha::Patrons->find( $borrowernumber ); $data = $patron->unblessed; } -- 1.7.9.5