Attachment 65893 Details for Bug 19054 – Bug 19054 - XSS Flaws in Report - Top Most-circulated items

[patch] Bug 19054 - XSS Flaws in Report - Top Most-circulated items

Bug-19054---XSS-Flaws-in-Report---Top-Most-circula.patch (text/plain), 1.58 KB, created by Marcel de Rooy on 2017-08-11 09:30:48 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2017-08-11 09:30:48 UTC

Size: 1.58 KB

patch

obsolete

>From 89a6032110d1931cdfe5f6c2ae7021dd8da9d0d5 Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Mon, 7 Aug 2017 22:34:05 +0530
>Subject: [PATCH] Bug 19054 - XSS Flaws in Report - Top Most-circulated items
>Content-Type: text/plain; charset=utf-8
>
>1. Hit /cgi-bin/koha/reports/cat_issues_top.pl
>2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> in Callnumber, Day, Month, Year search box.
>3. Notice the iframe is executed.
>4. Apply patch.
>5. Reload page, and enter iframe again on Callnumber, Day, Month, Year search box.
>6. Notice it is no longer executed.
>
>Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>---
> koha-tmpl/intranet-tmpl/prog/en/modules/reports/cat_issues_top.tt | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cat_issues_top.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cat_issues_top.tt
>index 7365de1..555ea64 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cat_issues_top.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cat_issues_top.tt
>@@ -59,7 +59,7 @@
> 		[% IF ( mainloo.loopfilter ) %]
>             <p>Filtered on:</p>
> 			[% FOREACH loopfilte IN mainloo.loopfilter %]
>-					<p>[% IF ( loopfilte.err ) %]  [% END %] [% loopfilte.crit %] =[% loopfilte.filter %][% IF ( loopfilte.err ) %]  [% END %]</p>
>+                    <p>[% IF ( loopfilte.err ) %]  [% END %] [% loopfilte.crit %] =[% loopfilte.filter |html %][% IF ( loopfilte.err ) %]  [% END %]</p>
> 			[% END %]
> 		[% END %]
> 		
>-- 
>2.1.4

Actions: View | Diff | Splinter Review

Attachments on bug 19054: 65589 | 65605 | 65893