Bugzilla – Attachment 65580 Details for
Bug 19051
XSS Flaws in - Batch record deletion page - Batch item deletion page - Batch item modification page
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 19051 - XSS Flaws in - Batch record deletion page
0001-Bug-19051-XSS-Flaws-in-Batch-record-deletion-page.patch (text/plain), 1.79 KB, created by
Amit Gupta
on 2017-08-07 15:43:09 UTC
(
hide
)
Description:
Bug 19051 - XSS Flaws in - Batch record deletion page
Filename:
MIME Type:
Creator:
Amit Gupta
Created:
2017-08-07 15:43:09 UTC
Size:
1.79 KB
patch
obsolete
>From c75605d9e8e56bcdeaf24d0d9e9551e9c4474492 Mon Sep 17 00:00:00 2001 >From: Amit Gupta <amit.gupta@informaticsglobal.com> >Date: Mon, 7 Aug 2017 21:08:36 +0530 >Subject: [PATCH] Bug 19051 - XSS Flaws in - Batch record deletion page > >1. Hit /cgi-bin/koha/tools/batch_delete_records.pl >2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> in the Record number list (one per line) text area. >3. Notice the iframe is executed. >4. Apply patch. >5. Reload page, and enter iframe again on Record number list (one per line) text area. >6. Notice it is no longer executed. >7. Fixes for both biblio and authority records. >--- > .../prog/en/modules/tools/batch_delete_records.tt | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt >index 58249ee..20777c8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt >@@ -104,9 +104,9 @@ $(document).ready(function() { > <div class="dialog error" style="margin:auto;"> > [% END %] > [% IF message.code == 'biblio_not_exists' %] >- The biblionumber [% message.biblionumber %] does not exist in the database. >+ The biblionumber [% message.biblionumber |html %] does not exist in the database. > [% ELSIF message.code == 'authority_not_exists' %] >- The authority id [% message.authid %] does not exist in the database. >+ The authority id [% message.authid |html %] does not exist in the database. > [% ELSIF message.code == 'item_issued' %] > At least one item is checked out on bibliographic record [% message.biblionumber %]. > [% ELSIF message.code == 'reserve_not_cancelled' %] >-- >1.7.9.5 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 19051
:
65580
|
65584
|
65585
|
65597
|
65598
|
65599
|
65888
|
65889
|
65890