Attachment 65888 Details for Bug 19051 – Bug 19051 - XSS Flaws in - Batch record deletion page

[patch] Bug 19051 - XSS Flaws in - Batch record deletion page

Bug-19051---XSS-Flaws-in---Batch-record-deletion-p.patch (text/plain), 1.96 KB, created by Marcel de Rooy on 2017-08-11 09:26:42 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2017-08-11 09:26:42 UTC

Size: 1.96 KB

patch

obsolete

>From 8fe0eabc33b35aacd05022cad4e4b31dbc8f8cae Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Mon, 7 Aug 2017 21:08:36 +0530
>Subject: [PATCH] Bug 19051 - XSS Flaws in - Batch record deletion page
>Content-Type: text/plain; charset=utf-8
>
>1. Hit /cgi-bin/koha/tools/batch_delete_records.pl
>2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> in the Record number list (one per line) text area.
>3. Notice the iframe is executed.
>4. Apply patch.
>5. Reload page, and enter iframe again on Record number list (one per line) text area.
>6. Notice it is no longer executed.
>7. Fixes for both biblio and authority records.
>
>Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>---
> koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt
>index 58249ee..20777c8 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt
>@@ -104,9 +104,9 @@ $(document).ready(function() {
>       <div class="dialog error" style="margin:auto;">
>     [% END %]
>     [% IF message.code == 'biblio_not_exists' %]
>-      The biblionumber [% message.biblionumber %] does not exist in the database.
>+      The biblionumber [% message.biblionumber |html %] does not exist in the database.
>     [% ELSIF message.code == 'authority_not_exists' %]
>-      The authority id [% message.authid %] does not exist in the database.
>+      The authority id [% message.authid |html %] does not exist in the database.
>     [% ELSIF message.code == 'item_issued' %]
>       At least one item is checked out on bibliographic record [% message.biblionumber %].
>     [% ELSIF message.code == 'reserve_not_cancelled' %]
>-- 
>2.1.4

Actions: View | Diff | Splinter Review

Attachments on bug 19051: 65580 | 65584 | 65585 | 65597 | 65598 | 65599 | 65888 | 65889 | 65890