Bugzilla – Attachment 65832 Details for
Bug 19078
XSS Flaws in System preferences
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 19078 - XSS Flaws in System preferences
0001-Bug-19078-XSS-Flaws-in-System-preferences.patch (text/plain), 1.52 KB, created by
Amit Gupta
on 2017-08-10 16:24:47 UTC
(
hide
)
Description:
Bug 19078 - XSS Flaws in System preferences
Filename:
MIME Type:
Creator:
Amit Gupta
Created:
2017-08-10 16:24:47 UTC
Size:
1.52 KB
patch
obsolete
>From 163e8d081b34c226fe7cf6baa10c08797db15088 Mon Sep 17 00:00:00 2001 >From: Amit Gupta <amit.gupta@informaticsglobal.com> >Date: Thu, 10 Aug 2017 21:51:38 +0530 >Subject: [PATCH] Bug 19078 - XSS Flaws in System preferences > >1. Hit /cgi-bin/koha/admin/preferences.pl >2. Enter <script>alert('amit')</script> in search system preferences box. >3. Notice the java script is executed. >4. Apply patch. >5. Reload page, and enter <script>alert('amit')</script> in search system preferences box. >6. Notice it is no longer executed. >--- > .../prog/en/modules/admin/preferences.tt | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt >index 28ccddc..ed2aa03 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt >@@ -31,7 +31,7 @@ > }); > }); > // This is here because of its dependence on template variables, everything else should go in js/pages/preferences.js - jpw >- var to_highlight = "[% searchfield |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]"; >+ var to_highlight = "[% searchfield |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') |html %]"; > var search_jumped = [% IF ( search_jumped ) %]true[% ELSE %]false[% END %]; > var MSG_NOTHING_TO_SAVE = _("Nothing to save"); > var MSG_SAVING = _("Saving..."); >-- >1.7.9.5 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 19078
:
65832
|
65862
|
65872