Bugzilla – Attachment 184969 Details for
Bug 40538
XSS in hold suspend modal in staff interface
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 40538: Fix XSS in suspend hold modal
Bug-40538-Fix-XSS-in-suspend-hold-modal.patch (text/plain), 3.99 KB, created by
Marcel de Rooy
on 2025-08-01 07:31:02 UTC
(
hide
)
Description:
Bug 40538: Fix XSS in suspend hold modal
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2025-08-01 07:31:02 UTC
Size:
3.99 KB
patch
obsolete
>From 2067586a897cee0a48333b0e596d3d36cfb3af08 Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Tue, 29 Jul 2025 04:07:37 +0000 >Subject: [PATCH] Bug 40538: Fix XSS in suspend hold modal >Content-Type: text/plain; charset=utf-8 > >This patch fixes a XSS vulnerability in the >suspend hold modal in the staff interface. > >By building our Javascript using Web APIs rather >than with strings and jQuery's html() method, >we're able to securely handle malicious payloads. > >Test plan: >0. Apply the patch >1. Go to http://localhost:8081/cgi-bin/koha/reserve/request.pl?biblionumber=29 >2. Add a hold for "koha" patron >3. Go to http://localhost:8081/cgi-bin/koha/circ/circulation.pl?borrowernumber=51 >4. Click "Holds" tab and click "Suspend" >5. Note the modal loads properly >6. Go to http://localhost:8081/cgi-bin/koha/members/moremember.pl?borrowernumber=51 >7. Click "Holds" tab and click "Suspend" >8. Note the modal loads properly > >Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk> > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > koha-tmpl/intranet-tmpl/prog/js/holds.js | 33 +++++++++++++++++------- > 1 file changed, 23 insertions(+), 10 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/js/holds.js b/koha-tmpl/intranet-tmpl/prog/js/holds.js >index 752e0f5b6a..23e5d61973 100644 >--- a/koha-tmpl/intranet-tmpl/prog/js/holds.js >+++ b/koha-tmpl/intranet-tmpl/prog/js/holds.js >@@ -373,16 +373,29 @@ $(document).ready(function () { > "</a>" > ); > } else { >- return ( >- "<a class='hold-suspend btn btn-default btn-xs' data-hold-id='" + >- oObj.reserve_id + >- "' data-hold-title='" + >- oObj.title + >- "'>" + >- "<i class='fa fa-pause'></i> " + >- __("Suspend") + >- "</a>" >+ const link = document.createElement("a"); >+ link.classList.add( >+ "hold-suspend", >+ "btn", >+ "btn-default", >+ "btn-xs" >+ ); >+ link.setAttribute( >+ "data-hold-id", >+ oObj.reserve_id >+ ); >+ link.setAttribute( >+ "data-hold-title", >+ oObj.title >+ ); >+ link.textContent = " " + __("Suspend"); >+ const icon = document.createElement("i"); >+ icon.classList.add("fa", "fa-pause"); >+ link.insertAdjacentElement( >+ "afterbegin", >+ icon > ); >+ return link.outerHTML; > } > }, > }, >@@ -491,7 +504,7 @@ $(document).ready(function () { > $(".hold-suspend").on("click", function () { > var hold_id = $(this).data("hold-id"); > var hold_title = $(this).data("hold-title"); >- $("#suspend-modal-title").html(hold_title); >+ $("#suspend-modal-title").text(hold_title); > $("#suspend-modal-submit").data("hold-id", hold_id); > $("#suspend-modal").modal("show"); > }); >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 40538
:
184775
|
184790
|
184792
|
184969
|
184970
|
185739
|
185740
|
185741
|
185795