Attachment 65596 Details for Bug 19050 – Bug 19050 - XSS Flaws in Quick spine label creator

[patch] Bug 19050 - XSS Flaws in Quick spine label creator

Bug-19050---XSS-Flaws-in-Quick-spine-label-creator.patch (text/plain), 1.32 KB, created by Chris Cormack on 2017-08-07 20:32:55 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Cormack

Created: 2017-08-07 20:32:55 UTC

Size: 1.32 KB

patch

obsolete

>From 569080a794fac016c5dbabae78988db8e96d08d7 Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Mon, 7 Aug 2017 20:49:56 +0530
>Subject: [PATCH] Bug 19050 - XSS Flaws in Quick spine label creator
>
>1. Hit /cgi-bin/koha/labels/spinelabel-home.pl
>2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> barcode text box.
>3. Notice the iframe is executed
>4. Apply patch
>5. Reload page, and enter iframe again on barcode text box.
>6. Notice it is no longer executed
>
>Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
>---
> koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt
>index 85aaae4756..7881d335b7 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt
>@@ -23,7 +23,7 @@
> </head>
> 	[% IF ( BarcodeNotFound ) %]
> 		<body id="labels_spinelabel-print" class="tools labels">
>-			<p>The barcode [% Barcode %] was not found.</p>
>+			<p>The barcode [% Barcode |html %] was not found.</p>
>             <p><a href="spinelabel-home.pl">Return to spine label printer</a></p>
> 		</body>
> 	[% ELSE %]
>-- 
>2.13.3

Actions: View | Diff | Splinter Review

Attachments on bug 19050: 65573 | 65596 | 65887