Bugzilla – Attachment 120727 Details for
Bug 27942
QOTD: quote CSV uploads may contain JavaScript payloads (XSS)
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 27942: [<=20.05] Add escape_str() in staff-global.js
Bug-27942-2005-Add-escapestr-in-staff-globaljs.patch (text/plain), 847 bytes, created by
Victor Grousset/tuxayo
on 2021-05-08 21:33:56 UTC
(
hide
)
Description:
Bug 27942: [<=20.05] Add escape_str() in staff-global.js
Filename:
MIME Type:
Creator:
Victor Grousset/tuxayo
Created:
2021-05-08 21:33:56 UTC
Size:
847 bytes
patch
obsolete
>From 7145b62773eaa213c75dc2f8597b19c6a54a6749 Mon Sep 17 00:00:00 2001 >From: Victor Grousset/tuxayo <victor@tuxayo.net> >Date: Sat, 8 May 2021 23:30:14 +0200 >Subject: [PATCH] Bug 27942: [<=20.05] Add escape_str() in staff-global.js > >It was added in bug 27930 which in not in <= 20.05 >--- > koha-tmpl/intranet-tmpl/prog/js/staff-global.js | 4 ++++ > 1 file changed, 4 insertions(+) > >diff --git a/koha-tmpl/intranet-tmpl/prog/js/staff-global.js b/koha-tmpl/intranet-tmpl/prog/js/staff-global.js >index 4a63f20bab..487388360d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/js/staff-global.js >+++ b/koha-tmpl/intranet-tmpl/prog/js/staff-global.js >@@ -15,6 +15,10 @@ function formatstr(str, col) { > }); > } > >+function escape_str(s){ >+ return s != null ? s.escapeHtml() : ""; >+} >+ > var HtmlCharsToEscape = { > '&': '&', > '<': '<', >-- >2.31.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 27942
:
118363
|
118867
|
119043
|
120429
|
120482
|
120726
| 120727