Bugzilla – Attachment 53972 Details for
Bug 17028
request.pl is vulnerable to XSS attacks
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[PASSED QA] Bug 17028: Fix XSS in reserve/request.pl
PASSED-QA-Bug-17028-Fix-XSS-in-reserverequestpl.patch (text/plain), 1.00 KB, created by
Katrin Fischer
on 2016-08-03 21:19:39 UTC
(
hide
)
Description:
[PASSED QA] Bug 17028: Fix XSS in reserve/request.pl
Filename:
MIME Type:
Creator:
Katrin Fischer
Created:
2016-08-03 21:19:39 UTC
Size:
1.00 KB
patch
obsolete
>From beda209d1dbd3256ca49d8c45db25b2635daa961 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Tue, 2 Aug 2016 15:41:49 +0100 >Subject: [PATCH] [PASSED QA] Bug 17028: Fix XSS in reserve/request.pl > >Test plan: >Hit > /cgi-bin/koha/reserve/request.pl?biblionumber=1"><script type="text/javascript">alert("XSS")</script> > >=> Without this patch you will see the alert >=> With this patch, no more alert > >Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> > >Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> >--- > reserve/request.pl | 1 + > 1 file changed, 1 insertion(+) > >diff --git a/reserve/request.pl b/reserve/request.pl >index 8e1f458..1980abb 100755 >--- a/reserve/request.pl >+++ b/reserve/request.pl >@@ -212,6 +212,7 @@ my $borrowerinfo = GetMember( borrowernumber => $borrowernumber_hold ); > my $itemdata_enumchron = 0; > my @biblioloop = (); > foreach my $biblionumber (@biblionumbers) { >+ next unless $biblionumber =~ m|^\d+$|; > > my %biblioloopiter = (); > >-- >1.9.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 17028
:
53914
|
53932
| 53972