Attachment 51827 Details for Bug 16599 – Bug 16599: Fix XSS in opac-shareshelf.pl

[patch] Bug 16599: Fix XSS in opac-shareshelf.pl

Bug-16599-Fix-XSS-in-opac-shareshelfpl.patch (text/plain), 1.94 KB, created by Chris Cormack on 2016-05-26 11:26:09 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Cormack

Created: 2016-05-26 11:26:09 UTC

Size: 1.94 KB

patch

obsolete

>From 7de828e467cb0a8ce6d8215708add2dfdcc35177 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Thu, 26 May 2016 12:03:55 +0100
>Subject: [PATCH] Bug 16599: Fix XSS in opac-shareshelf.pl
>
>Test plan:
>- Create a list with the name "<script>alert(1)</script>"
>- On the shelf list, click on share
>=> Without this patch you will see the JS alert
>=> With this patch applied you won't see it
>
>Reported by Kaybee at Dionach
>
>Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
>---
> koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shareshelf.tt | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shareshelf.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shareshelf.tt
>index 8a9de13..fe4179b 100644
>--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shareshelf.tt
>+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shareshelf.tt
>@@ -50,7 +50,7 @@
>             <ol>
>             <input type="hidden" name="op" value="conf_invite"/>
>             <input type="hidden" name="shelfnumber" value="[% shelfnumber %]"/>
>-            <li><label for="name">List name:</label> [% shelfname %]</li>
>+            <li><label for="name">List name:</label> [% shelfname | html %]</li>
>             <li>
>                 <label for="invite_address">Email address:</label>
>                 <input id="invite_address" name="invite_address" size="40" />
>@@ -67,7 +67,7 @@
>     [% ELSIF op=='conf_invite' %]
>         <div id="conf_invite">
>         [% IF approvedaddress %]
>-        <p>An invitation to share list <i>[% shelfname %]</i> will be sent shortly to [% approvedaddress %].</p>
>+        <p>An invitation to share list <i>[% shelfname | html %]</i> will be sent shortly to [% approvedaddress %].</p>
>         [% END %]
>         [% IF failaddress %]
>             <p>Something went wrong while processing the following addresses. Please check them. These are: [% failaddress %]</p>
>-- 
>2.8.1

Actions: View | Diff | Splinter Review

Attachments on bug 16599: 51822 | 51824 | 51825 | 51827 | 51828 | 51865 | 51866