Bugzilla – Attachment 65887 Details for
Bug 19050
XSS Flaws in Quick spine label creator
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 19050 - XSS Flaws in Quick spine label creator
Bug-19050---XSS-Flaws-in-Quick-spine-label-creator.patch (text/plain), 1.42 KB, created by
Marcel de Rooy
on 2017-08-11 09:24:24 UTC
(
hide
)
Description:
Bug 19050 - XSS Flaws in Quick spine label creator
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2017-08-11 09:24:24 UTC
Size:
1.42 KB
patch
obsolete
>From 86c35879db3343b4aaaf5f5bc73657f46dafe869 Mon Sep 17 00:00:00 2001 >From: Amit Gupta <amit.gupta@informaticsglobal.com> >Date: Mon, 7 Aug 2017 20:49:56 +0530 >Subject: [PATCH] Bug 19050 - XSS Flaws in Quick spine label creator >Content-Type: text/plain; charset=utf-8 > >1. Hit /cgi-bin/koha/labels/spinelabel-home.pl >2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> barcode text box. >3. Notice the iframe is executed >4. Apply patch >5. Reload page, and enter iframe again on barcode text box. >6. Notice it is no longer executed > >Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt >index 85aaae4..47b3602 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt >@@ -23,7 +23,7 @@ > </head> > [% IF ( BarcodeNotFound ) %] > <body id="labels_spinelabel-print" class="tools labels"> >- <p>The barcode [% Barcode %] was not found.</p> >+ <p>The barcode [% Barcode |html %] was not found.</p> > <p><a href="spinelabel-home.pl">Return to spine label printer</a></p> > </body> > [% ELSE %] >-- >2.1.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 19050
:
65573
|
65596
| 65887