Attachment 65486 Details for Bug 19034 – Bug 19034 - XSS Flaws in Cities

[patch] Bug 19034 - XSS Flaws in Cities

0001-Bug-19034-XSS-Flaws-in-Cities.patch (text/plain), 1.05 KB, created by Amit Gupta on 2017-08-04 05:18:40 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Amit Gupta

Created: 2017-08-04 05:18:40 UTC

Size: 1.05 KB

patch

obsolete

>From d4c55e92128c384e5c015b5b989c63773b6ea47a Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Fri, 4 Aug 2017 10:38:12 +0530
>Subject: [PATCH 1/2] Bug 19034 - XSS Flaws in Cities
>
>1. Hit /cgi-bin/koha/admin/cities.pl
>2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search cities box.
>3. Notice the iframe is executed.
>4. Apply patch.
>5. Reload page, and enter iframe again on search cities box.
>6. Notice it is no longer executed.
>---
> .../intranet-tmpl/prog/en/modules/admin/cities.tt  |    2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
>index 7acb4d6..a440cf1 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
>@@ -143,7 +143,7 @@
> 
>     <h2>Cities</h2>
>     [% IF searchfield %]
>-        Searching: [% searchfield %]
>+        Searching: [% searchfield |html %]
>     [% END %]
> 
>     [% IF cities.count %]
>-- 
>1.7.9.5
>

Actions: View | Diff | Splinter Review

Attachments on bug 19034: 65485 | 65486 | 65487 | 65559 | 65560 | 65561 | 65562 | 66028