Bugzilla – Attachment 40373 Details for
Bug 14416
Stored XSS flaw affects OPAC and Staff interface
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[PASSED QA] Bug 14416: Stored XSS vulnerability - add biblio to shelf (intranet)
PASSED-QA-Bug-14416-Stored-XSS-vulnerability---add.patch (text/plain), 2.35 KB, created by
Katrin Fischer
on 2015-06-19 13:29:35 UTC
(
hide
)
Description:
[PASSED QA] Bug 14416: Stored XSS vulnerability - add biblio to shelf (intranet)
Filename:
MIME Type:
Creator:
Katrin Fischer
Created:
2015-06-19 13:29:35 UTC
Size:
2.35 KB
patch
obsolete
>From c50320c459879156a259a4a911844869a1a3a728 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@koha-community.org> >Date: Fri, 19 Jun 2015 11:21:56 +0200 >Subject: [PATCH] [PASSED QA] Bug 14416: Stored XSS vulnerability - add biblio > to shelf (intranet) > >Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> >Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> >--- > .../prog/en/modules/virtualshelves/addbybiblionumber.tt | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt >index 03b6005..8dae4bf 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt >@@ -17,9 +17,9 @@ > <div id="custom-doc" class="yui-t7"> > <div id="bd"> > [% IF ( multiple ) %] >- <h1>Add [% total %] items to [% IF ( singleshelf ) %]<em>[% shelfname %]</em>: [% ELSE %]a list:[% END %]</h1> >+ <h1>Add [% total %] items to [% IF ( singleshelf ) %]<em>[% shelfname | html%]</em>: [% ELSE %]a list:[% END %]</h1> > [% ELSE %] >- <h1>Add to [% IF ( singleshelf ) %]<em>[% shelfname %]</em>[% ELSE %]a list:[% END %]</h1> >+ <h1>Add to [% IF ( singleshelf ) %]<em>[% shelfname | html %]</em>[% ELSE %]a list:[% END %]</h1> > [% END %] > <ul> > [% FOREACH biblio IN biblios %] >@@ -46,14 +46,14 @@ > [% IF ( privatevirtualshelves ) %] > <optgroup label="Private lists"> > [% FOREACH privatevirtualshelve IN privatevirtualshelves %] >- <option value="[% privatevirtualshelve.shelfnumber %]">[% privatevirtualshelve.shelfname %]</option> >+ <option value="[% privatevirtualshelve.shelfnumber %]">[% privatevirtualshelve.shelfname | html%]</option> > [% END %] > </optgroup> > [% END %] > [% IF ( publicvirtualshelves ) %] > <optgroup label="Public lists"> > [% FOREACH publicvirtualshelve IN publicvirtualshelves %] >- <option value="[% publicvirtualshelve.shelfnumber %]">[% publicvirtualshelve.shelfname %]</option> >+ <option value="[% publicvirtualshelve.shelfnumber %]">[% publicvirtualshelve.shelfname | html%]</option> > [% END %] > </optgroup> > [% END %] >-- >1.7.10.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 14416
:
40333
|
40340
|
40341
|
40353
|
40354
|
40355
|
40356
|
40370
|
40371
|
40372
| 40373