From 34e7c03add1b0083f27fbcae55d8602c7a3fe5d9 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Tue, 15 Aug 2017 10:15:54 +0530 Subject: [PATCH 2/2] Bug 19103 - Stored XSS in matching-rules.pl To Test 1. Hit the page /cgi-bin/koha/admin/matching-rules.pl 2. Click on new record matching rule 3. Add a text in the field Description that contain js. 4. Save the page. 5. Notice js is execute 6. Apply patch and reload, the js is escaped --- .../prog/en/modules/admin/matching-rules.tt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt index e75398c..6c15b2b 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt @@ -602,7 +602,7 @@ function CheckRuleForm(f) { [% available_matching_rule.matcher_id %] [% available_matching_rule.code %] - [% available_matching_rule.description %] + [% available_matching_rule.description |html %] Edit Delete -- 1.7.9.5