Attachment 65890 Details for Bug 19051 – Bug 19051 - XSS Flaws in - Batch item modification page

[patch] Bug 19051 - XSS Flaws in - Batch item modification page

Bug-19051---XSS-Flaws-in---Batch-item-modification.patch (text/plain), 1.46 KB, created by Marcel de Rooy on 2017-08-11 09:26:50 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2017-08-11 09:26:50 UTC

Size: 1.46 KB

patch

obsolete

>From 4decfb908c9779cabe1e14cbf2811cd615e4e2da Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Mon, 7 Aug 2017 21:43:56 +0530
>Subject: [PATCH] Bug 19051 - XSS Flaws in - Batch item modification page
>Content-Type: text/plain; charset=utf-8
>
>1. Hit /cgi-bin/koha/tools/batchMod.pl
>2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> in the Barcode list (one barcode per line) text area.
>3. Notice the iframe is executed.
>4. Apply patch.
>5. Reload page, and enter iframe again on Barcode list (one barcode per line) text area.
>6. Notice it is no longer executed.
>7. Fixes for both barcode and itemnumber.
>
>Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>---
> koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt
>index 2b746ab..c25dfe4 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt
>@@ -98,7 +98,7 @@ $(document).ready(function(){
>     </thead>
>     <tbody>
>         [% FOREACH notfoundbarcode IN notfoundbarcodes %]
>-      <tr><td>[% notfoundbarcode.barcode %]</td></td>
>+      <tr><td>[% notfoundbarcode.barcode |html %]</td></td>
>         [% END %]
>     </tbody>
>       </table>
>-- 
>2.1.4

Actions: View | Diff | Splinter Review

Attachments on bug 19051: 65580 | 65584 | 65585 | 65597 | 65598 | 65599 | 65888 | 65889 | 65890