Attachment 65585 Details for Bug 19051 – Bug 19051 - XSS Flaws in - Batch item modification page

[patch] Bug 19051 - XSS Flaws in - Batch item modification page

0001-Bug-19051-XSS-Flaws-in-Batch-item-modification-page.patch (text/plain), 1.31 KB, created by Amit Gupta on 2017-08-07 16:19:44 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Amit Gupta

Created: 2017-08-07 16:19:44 UTC

Size: 1.31 KB

patch

obsolete

>From ef90a8d97bb64af7b1908b6d0d61723b85cef06f Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Mon, 7 Aug 2017 21:43:56 +0530
>Subject: [PATCH] Bug 19051 - XSS Flaws in - Batch item modification page
>
>1. Hit /cgi-bin/koha/tools/batchMod.pl
>2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> in the Barcode list (one barcode per line) text area.
>3. Notice the iframe is executed.
>4. Apply patch.
>5. Reload page, and enter iframe again on Barcode list (one barcode per line) text area.
>6. Notice it is no longer executed.
>7. Fixes for both barcode and itemnumber.
>---
> .../prog/en/modules/tools/batchMod-edit.tt         |    2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt
>index 2b746ab..c25dfe4 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt
>@@ -98,7 +98,7 @@ $(document).ready(function(){
>     </thead>
>     <tbody>
>         [% FOREACH notfoundbarcode IN notfoundbarcodes %]
>-      <tr><td>[% notfoundbarcode.barcode %]</td></td>
>+      <tr><td>[% notfoundbarcode.barcode |html %]</td></td>
>         [% END %]
>     </tbody>
>       </table>
>-- 
>1.7.9.5
>

Actions: View | Diff | Splinter Review

Attachments on bug 19051: 65580 | 65584 | 65585 | 65597 | 65598 | 65599 | 65888 | 65889 | 65890