Bugzilla – Attachment 53914 Details for
Bug 17028
request.pl is vulnerable to XSS attacks
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 17028: Fix XSS in reserve/request.pl
Bug-17028-Fix-XSS-in-reserverequestpl.patch (text/plain), 901 bytes, created by
Jonathan Druart
on 2016-08-02 14:46:03 UTC
(
hide
)
Description:
Bug 17028: Fix XSS in reserve/request.pl
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2016-08-02 14:46:03 UTC
Size:
901 bytes
patch
obsolete
>From 0c0fa3b83ec12877360e4ed1115a9b88dcc6d8df Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Tue, 2 Aug 2016 15:41:49 +0100 >Subject: [PATCH] Bug 17028: Fix XSS in reserve/request.pl > >Test plan: >Hit > /cgi-bin/koha/reserve/request.pl?biblionumber=1"><script type="text/javascript">alert("XSS")</script> > >=> Without this patch you will see the alert >=> With this patch, no more alert >--- > reserve/request.pl | 1 + > 1 file changed, 1 insertion(+) > >diff --git a/reserve/request.pl b/reserve/request.pl >index 8e1f458..1980abb 100755 >--- a/reserve/request.pl >+++ b/reserve/request.pl >@@ -212,6 +212,7 @@ my $borrowerinfo = GetMember( borrowernumber => $borrowernumber_hold ); > my $itemdata_enumchron = 0; > my @biblioloop = (); > foreach my $biblionumber (@biblionumbers) { >+ next unless $biblionumber =~ m|^\d+$|; > > my %biblioloopiter = (); > >-- >2.8.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 17028
:
53914
|
53932
|
53972