Bugzilla – Attachment 108088 Details for
Bug 26102
Javascript injection in intranet search
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 26102: Prevent XSS when To.json is used: subscription-add.tt
Bug-26102-Prevent-XSS-when-Tojson-is-used-subscrip.patch (text/plain), 1.42 KB, created by
Owen Leonard
on 2020-08-11 15:50:00 UTC
(
hide
)
Description:
Bug 26102: Prevent XSS when To.json is used: subscription-add.tt
Filename:
MIME Type:
Creator:
Owen Leonard
Created:
2020-08-11 15:50:00 UTC
Size:
1.42 KB
patch
obsolete
>From 4e6c58c2ca752ddbdb90f298ef24933044952841 Mon Sep 17 00:00:00 2001 >From: Owen Leonard <oleonard@myacpl.org> >Date: Tue, 11 Aug 2020 15:22:33 +0000 >Subject: [PATCH] Bug 26102: Prevent XSS when To.json is used: > subscription-add.tt > >Test the process of adding a subscription, entering both a valid vendor >ID and a non-existent vendor ID. The non-existent vendor ID should >trigger a validation alert. >--- > koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt >index 1075e14d19..8623f43a88 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt >@@ -556,7 +556,7 @@ fieldset.rows table { clear: none; margin: 0; } > var MSG_MANA_NO_SUBSCRIPTION_FOUND = _("No subscription found on Mana Knowledge Base"); > var MSG_MANA_SHARE_PATTERN = _("Please feel free to share your pattern with all others librarians once you are done"); > >- var BOOKSELLER_IDS = [% To.json( bookseller_ids ) || '[]' | $raw %]; >+ var BOOKSELLER_IDS = [% To.json( bookseller_ids ) || '[]' | html %]; > </script> > [% Asset.js("js/subscription-add.js") | $raw %] > [% Asset.js("js/showpredictionpattern.js") | $raw %] >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 26102
:
107579
|
108083
|
108084
|
108085
|
108086
|
108087
|
108088
|
108089
|
108090
|
119643
|
119644
|
119645
|
119646
|
119647
|
119648
|
119649
|
127669
|
127670
|
127671
|
127672
|
127673
|
127674
|
127675
|
128716
|
128717
|
128718
|
128719
|
128720
|
128721
|
128722
|
130931
|
130932
|
130933
|
130934
|
130935
|
130936
|
130999
|
131000
|
131001
|
131002
|
131003
|
131004