Bugzilla – Attachment 164119 Details for
Bug 36382
XSS in showLastPatron dropdown
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36382: XSS in showLastPatron dropdown
Bug-36382-XSS-in-showLastPatron-dropdown.patch (text/plain), 1.79 KB, created by
Marcel de Rooy
on 2024-03-29 09:26:31 UTC
(
hide
)
Description:
Bug 36382: XSS in showLastPatron dropdown
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2024-03-29 09:26:31 UTC
Size:
1.79 KB
patch
obsolete
>From d1ffecff238358362f174b1292fc044d74ad215f Mon Sep 17 00:00:00 2001 >From: Kyle M Hall <kyle@bywatersolutions.com> >Date: Thu, 21 Mar 2024 09:30:26 -0400 >Subject: [PATCH] Bug 36382: XSS in showLastPatron dropdown >Content-Type: text/plain; charset=utf-8 > >1) Set borrower surname to: > <script>alert("here comes trouble");</script> >2) Save, nothing happens >3) Enable showLastPatron >4) Reload patron >5) Note the alert popup >6) Apply this patch >7) Reload patron >8) No alert! > >Signed-off-by: Owen Leonard <oleonard@myacpl.org> > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > koha-tmpl/intranet-tmpl/prog/js/staff-global.js | 10 ++++++---- > 1 file changed, 6 insertions(+), 4 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/js/staff-global.js b/koha-tmpl/intranet-tmpl/prog/js/staff-global.js >index 7e4567bc59..636522fa44 100644 >--- a/koha-tmpl/intranet-tmpl/prog/js/staff-global.js >+++ b/koha-tmpl/intranet-tmpl/prog/js/staff-global.js >@@ -19,7 +19,9 @@ function formatstr(str, col) { > var HtmlCharsToEscape = { > '&': '&', > '<': '<', >- '>': '>' >+ '>': '>', >+ "'": ''', >+ '"': '"' > }; > String.prototype.escapeHtml = function() { > return this.replace(/[&<>]/g, function(c) { >@@ -176,9 +178,9 @@ $(document).ready(function() { > }); > > const previous_patron = { >- "borrowernumber": $("#hiddenborrowernumber").val(), >- "name": $("#hiddenborrowername").val(), >- "card": $("#hiddenborrowercard").val() >+ "borrowernumber": escape_str($("#hiddenborrowernumber").val()), >+ "name": escape_str($("#hiddenborrowername").val()), >+ "card": escape_str($("#hiddenborrowercard").val()) > }; > > previous_patrons.unshift( previous_patron ); >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36382
:
163615
|
163727
|
164119
|
164123
|
166717
|
166718