Bugzilla – Attachment 166717 Details for
Bug 36382
XSS in showLastPatron dropdown
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36382: XSS in showLastPatron dropdown
Bug-36382-XSS-in-showLastPatron-dropdown.patch (text/plain), 1.75 KB, created by
Tomás Cohen Arazi (tcohen)
on 2024-05-14 17:46:11 UTC
(
hide
)
Description:
Bug 36382: XSS in showLastPatron dropdown
Filename:
MIME Type:
Creator:
Tomás Cohen Arazi (tcohen)
Created:
2024-05-14 17:46:11 UTC
Size:
1.75 KB
patch
obsolete
>From 97ced22ff6ab3d76c41d7d694868a1e5fd49b211 Mon Sep 17 00:00:00 2001 >From: Kyle M Hall <kyle@bywatersolutions.com> >Date: Thu, 21 Mar 2024 09:30:26 -0400 >Subject: [PATCH] Bug 36382: XSS in showLastPatron dropdown > >1) Set borrower surname to: > <script>alert("here comes trouble");</script> >2) Save, nothing happens >3) Enable showLastPatron >4) Reload patron >5) Note the alert popup >6) Apply this patch >7) Reload patron >8) No alert! > >Signed-off-by: Owen Leonard <oleonard@myacpl.org> >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >--- > koha-tmpl/intranet-tmpl/prog/js/staff-global.js | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/js/staff-global.js b/koha-tmpl/intranet-tmpl/prog/js/staff-global.js >index e2b9d175d9b..d68bb9a56ad 100644 >--- a/koha-tmpl/intranet-tmpl/prog/js/staff-global.js >+++ b/koha-tmpl/intranet-tmpl/prog/js/staff-global.js >@@ -31,6 +31,8 @@ var HtmlCharsToEscape = { > "&": "&", > "<": "<", > ">": ">", >+ "'": ''', >+ '"': '"' > }; > String.prototype.escapeHtml = function () { > return this.replace(/[&<>]/g, function (c) { >@@ -204,9 +206,9 @@ $(document).ready(function () { > }); > > const previous_patron = { >- borrowernumber: $("#hiddenborrowernumber").val(), >- name: $("#hiddenborrowername").val(), >- card: $("#hiddenborrowercard").val(), >+ borrowernumber: escape_str($("#hiddenborrowernumber").val()), >+ name: escape_str($("#hiddenborrowername").val()), >+ card: escape_str($("#hiddenborrowercard").val()) > }; > > previous_patrons.unshift(previous_patron); >-- >2.45.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36382
:
163615
|
163727
|
164119
|
164123
| 166717 |
166718