Bugzilla – Attachment 170801 Details for
Bug 37720
XSS (and bustage) in label creator
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[alternative-patch] Bug 37720: Prevent XSS in label creator
Bug-37720-Prevent-XSS-in-label-creator.patch (text/plain), 3.26 KB, created by
Jonathan Druart
on 2024-08-28 10:19:03 UTC
(
hide
)
Description:
[alternative-patch] Bug 37720: Prevent XSS in label creator
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2024-08-28 10:19:03 UTC
Size:
3.26 KB
patch
obsolete
>From 0aef4c0270a3acd017a999fdd06b94b9972200fd Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Wed, 28 Aug 2024 12:18:06 +0200 >Subject: [PATCH] Bug 37720: Prevent XSS in label creator > >--- > C4/Creators/Lib.pm | 3 +-- > .../intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt | 5 ++++- > 2 files changed, 5 insertions(+), 3 deletions(-) > >diff --git a/C4/Creators/Lib.pm b/C4/Creators/Lib.pm >index d4831ab4797..169ba008de0 100644 >--- a/C4/Creators/Lib.pm >+++ b/C4/Creators/Lib.pm >@@ -345,8 +345,7 @@ sub get_label_summary { > $record->{'title'} =~ s/\W*$//; # strip off ugly trailing chars > # FIXME contructing staff interface URLs should be done *much* higher up the stack - for the most part, C4 module code > # should not know that it's part of a web app >- $record->{'title'} = '<a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=' . $record->{'biblionumber'} . '"> ' . $record->{'title'} . '</a>'; >- $label_summary->{'_summary'} = $record->{'title'} . " | " . ($record->{'author'} ? $record->{'author'} : 'N/A'); >+ $label_summary->{'_summary'} = { title => $record->{title}, author => $record->{author}, biblionumber => $record->{biblionumber} }; > $label_summary->{'_item_type'} = C4::Context->preference("item-level_itypes") ? $record->{'itype'} : $record->{'itemtype'}; > $label_summary->{'_barcode'} = $record->{'barcode'}; > $label_summary->{'_item_number'} = $item->{'item_number'}; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt >index aef3a313cc7..09b1f111781 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt >@@ -176,8 +176,11 @@ > <td> > [% IF ( text_field.field_name == '_item_type_tbl' ) %] > [% ItemTypes.GetDescription( text_field.field_value ) | html %] >+ [% ELSIF ( text_field.field_name == '_summary_tbl' ) %] >+ <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% text_field.field_value.biblionumber | uri %]">[% text_field.field_value.title | html %]</a> >+ | [% IF text_field.field_value.author %][% text_field.field_value.author | html %][% ELSE %]N/A[% END %] > [% ELSE %] >- [% text_field.field_value | $raw %] >+ [% text_field.field_value | html %] > [% END %] > </td> > [% END %] >-- >2.34.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 37720
:
170675
|
170676
|
170691
|
170801
|
170851
|
170852
|
171565
|
172239