From dc986791b85672c51680144fee3082165bb70a99 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Tue, 15 Aug 2017 10:07:45 +0530 Subject: [PATCH] [SIGNED OFF] Bug 19103 - Stored XSS in patron-attr-types.pl To Test 1. Hit the page /cgi-bin/koha/admin/patron-attr-types.pl 2. Click on new patron attribute type 2. Add a text in the field Description that contain js. 2. Save the page. 3. Notice js is execute 4. Apply patch and reload, the js is escaped Signed-off-by: Katrin Fischer --- koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt index b0c49bf..55c5f40 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt @@ -272,7 +272,7 @@ $(document).ready(function() { [% FOREACH item IN attribute.items %] [% item.code |html %] - [% item.description %] + [% item.description |html %] [% IF ( item.branches && item.branches.size > 0 ) %] [% branches_str = "" %] -- 2.7.4