Attachment 65598 Details for Bug 19051 – Bug 19051 - XSS Flaws in Batch item deletion page

[patch] Bug 19051 - XSS Flaws in Batch item deletion page

Bug-19051---XSS-Flaws-in-Batch-item-deletion-page.patch (text/plain), 1.35 KB, created by Chris Cormack on 2017-08-07 20:36:56 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Cormack

Created: 2017-08-07 20:36:56 UTC

Size: 1.35 KB

patch

obsolete

>From 7c7e167aa1bffec38b8795b0a0c3ff9cdea9f782 Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Mon, 7 Aug 2017 21:24:44 +0530
>Subject: [PATCH] Bug 19051 - XSS Flaws in Batch item deletion page
>
>1. Hit /cgi-bin/koha/tools/batchMod.pl?del=1
>2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> in the Barcode list (one barcode per line) text area.
>3. Notice the iframe is executed.
>4. Apply patch.
>5. Reload page, and enter iframe again on Barcode list (one barcode per line) text area.
>6. Notice it is no longer executed.
>7. Fixes for both barcode and itemnumber.
>
>Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
>---
> koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt
>index d66d15d502..fbf8a7b232 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt
>@@ -58,7 +58,7 @@ $(document).ready(function(){
> 		</thead>
> 		<tbody>
> 		    [% FOREACH notfoundbarcode IN notfoundbarcodes %]
>-			<tr><td>[% notfoundbarcode.barcode %]</td></tr>
>+			<tr><td>[% notfoundbarcode.barcode |html %]</td></tr>
> 		    [% END %]
> 		</tbody>
> 	    </table>
>-- 
>2.13.3

Actions: View | Diff | Splinter Review

Attachments on bug 19051: 65580 | 65584 | 65585 | 65597 | 65598 | 65599 | 65888 | 65889 | 65890