Bugzilla – Attachment 193741 Details for
Bug 14962
Temp Shelving Location / On Display Module
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 14962: (QA follow-up) Fix stored XSS in display_name rendering in item table
23a53be.patch (text/plain), 2.24 KB, created by
Martin Renvoize (ashimema)
on 2026-02-24 13:36:51 UTC
(
hide
)
Description:
Bug 14962: (QA follow-up) Fix stored XSS in display_name rendering in item table
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2026-02-24 13:36:51 UTC
Size:
2.24 KB
patch
obsolete
>From 23a53bea9061ef42097a217a89cccfb357d4c760 Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@openfifth.co.uk> >Date: Tue, 24 Feb 2026 12:58:41 +0000 >Subject: [PATCH] Bug 14962: (QA follow-up) Fix stored XSS in display_name > rendering in item table > >display_name was concatenated directly into an HTML string via .format() >with no escaping. A display name containing HTML/JS would execute as >stored XSS for all staff viewing item details. > >Use jQuery DOM construction instead so display_name is treated as text, >not markup. > >Sponsored-by: ByWater Solutions >Signed-of-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> >--- > .../html_helpers/tables/items/catalogue_detail.inc | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/html_helpers/tables/items/catalogue_detail.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/html_helpers/tables/items/catalogue_detail.inc >index 53dd6d781cc..d26b329aee0 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/html_helpers/tables/items/catalogue_detail.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/html_helpers/tables/items/catalogue_detail.inc >@@ -729,8 +729,12 @@ > [% IF Koha.Preference('UseDisplayModule') && CAN_user_displays %] > displays.forEach(display => { > display.display_items.forEach(display_item => { >- if (display_item.itemnumber === row.item_id) >- nodes += '<li><span class="on_display"><a href="/cgi-bin/koha/display/displays/%s">%s</a></span></li>'.format(display.display_id, display.display_name); >+ if (display_item.itemnumber === row.item_id) { >+ const link = $("<a>") >+ .attr("href", "/cgi-bin/koha/display/displays/" + display.display_id) >+ .text(display.display_name); >+ nodes += $("<li>").append($('<span class="on_display">').append(link)).prop("outerHTML"); >+ } > }); > }); > >-- >2.53.0 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 14962
:
190216
|
190217
|
190218
|
190219
|
190220
|
190221
|
190222
|
190223
|
190224
|
190225
|
190226
|
190227
|
190228
|
190229
|
190230
|
190231
|
190232
|
190571
|
190572
|
193719
|
193720
|
193721
|
193722
|
193723
|
193724
|
193725
|
193726
|
193727
|
193728
|
193729
|
193730
|
193731
|
193732
|
193733
|
193734
|
193735
|
193736
|
193737
|
193738
|
193739
|
193740
|
193741
|
193742
|
193743
|
193744
|
193745
|
193746
|
193747
|
193748
|
193749
|
193750
|
193751
|
193752
|
193753
|
193754
|
193755
|
194285
|
194286
|
194287
|
194288
|
194289
|
194290
|
194291
|
194292
|
194293
|
194294
|
194295
|
194296
|
194297
|
194298
|
194299
|
194300
|
194301
|
194302
|
194303
|
194304
|
194305
|
194306
|
194307
|
194308
|
194309
|
194310
|
194311
|
194312
|
194313
|
194314
|
194315
|
194316
|
194317
|
194318
|
194320
|
194321
|
194322