Attachment 54112 Details for Bug 17036 – [PASSED QA] Bug 17036: Fix XSS in circulation.pl

[patch] [PASSED QA] Bug 17036: Fix XSS in circulation.pl

PASSED-QA-Bug-17036-Fix-XSS-in-circulationpl.patch (text/plain), 1.17 KB, created by Katrin Fischer on 2016-08-07 10:03:05 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Katrin Fischer

Created: 2016-08-07 10:03:05 UTC

Size: 1.17 KB

patch

obsolete

>From a2f1089ac2d78f48b30ba595b4169ea46a4cb842 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Wed, 3 Aug 2016 08:49:10 +0100
>Subject: [PATCH] [PASSED QA] Bug 17036: Fix XSS in circulation.pl
>
>Test plan:
>Enter the following in the "Check out" tab:
>"><script>alert('XSS')</script>
>
>=> Without this patch you will see the alert
>=> With this patch, no more alert
>
>Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
>
>Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
>---
> koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
>index b305b85..4d3965c 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
>@@ -538,7 +538,7 @@ $(document).ready(function() {
> [% IF ( message ) %]
> [% INCLUDE 'patron-toolbar.inc' %]
> <h4>
>-No patron matched <span class="ex">[% message %]</span>
>+No patron matched <span class="ex">[% message | html %]</span>
> </h4>
> [% END %]
> 
>-- 
>1.9.1

Actions: View | Diff | Splinter Review

Attachments on bug 17036: 53934 | 53984 | 54112