Attachment 65584 Details for Bug 19051 – Bug 19051 - XSS Flaws in Batch item deletion page

[patch] Bug 19051 - XSS Flaws in Batch item deletion page

0001-Bug-19051-XSS-Flaws-in-Batch-item-deletion-page.patch (text/plain), 1.29 KB, created by Amit Gupta on 2017-08-07 16:18:26 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Amit Gupta

Created: 2017-08-07 16:18:26 UTC

Size: 1.29 KB

patch

obsolete

>From 4f191acc00b0f152732efe12957e4df9f1c7d871 Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Mon, 7 Aug 2017 21:24:44 +0530
>Subject: [PATCH] Bug 19051 - XSS Flaws in Batch item deletion page
>
>1. Hit /cgi-bin/koha/tools/batchMod.pl?del=1
>2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> in the Barcode list (one barcode per line) text area.
>3. Notice the iframe is executed.
>4. Apply patch.
>5. Reload page, and enter iframe again on Barcode list (one barcode per line) text area.
>6. Notice it is no longer executed.
>7. Fixes for both barcode and itemnumber.
>---
> .../prog/en/modules/tools/batchMod-del.tt          |    2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt
>index d66d15d..fbf8a7b 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt
>@@ -58,7 +58,7 @@ $(document).ready(function(){
> 		</thead>
> 		<tbody>
> 		    [% FOREACH notfoundbarcode IN notfoundbarcodes %]
>-			<tr><td>[% notfoundbarcode.barcode %]</td></tr>
>+			<tr><td>[% notfoundbarcode.barcode |html %]</td></tr>
> 		    [% END %]
> 		</tbody>
> 	    </table>
>-- 
>1.7.9.5
>

Actions: View | Diff | Splinter Review

Attachments on bug 19051: 65580 | 65584 | 65585 | 65597 | 65598 | 65599 | 65888 | 65889 | 65890