Attachment 65987 Details for Bug 19086 – Bug 19086 Stored XSS in subscription-add.pl

[patch] Bug 19086 Stored XSS in subscription-add.pl

0001-Bug-19086-Stored-XSS-in-subscription-add.pl.patch (text/plain), 1.86 KB, created by Amit Gupta on 2017-08-14 21:33:27 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Amit Gupta

Created: 2017-08-14 21:33:27 UTC

Size: 1.86 KB

patch

obsolete

>From 8752be955eb956a7d38d2209e5bf77b8e8ffc363 Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Tue, 15 Aug 2017 02:44:11 +0530
>Subject: [PATCH] Bug 19086 Stored XSS in subscription-add.pl
>
>To Test
>1. Hit the page /cgi-bin/koha/serials/subscription-add.pl
>2. Add a text in the field Public note and Nonpublic note
> that contains js (Internalnotes, notes)
>2. Save the page.
>3. Notice js is execute
>4. Apply patch and reload, the js is escaped
>---
> .../prog/en/modules/serials/subscription-detail.tt | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt
>index 8c95459..a943120 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt
>@@ -339,8 +339,8 @@ $(document).ready(function() {
> <li>History end date: [% histenddate %]</li>
> <li>Received issues:[% recievedlist %]</li>
> <li>Missing issues:[% missinglist %]</li>
>- <li>Nonpublic note:[% internalnotes FILTER html_line_break %]</li>
>- <li>Public note:[% notes FILTER html_line_break %]</li>
>+ <li>Nonpublic note:[% internalnotes FILTER html_line_break |html %]</li>
>+ <li>Public note:[% notes FILTER html_line_break |html %]</li>
> <li>History staff note:[% librariannote FILTER html_line_break %]</li>
> <li>History OPAC note:[% opacnote FILTER html_line_break %]</li>
> </ol>
>-- 
>1.7.9.5
>

Actions: View | Diff | Splinter Review

Attachments on bug 19086: 65927 | 65929 | 65958 | 65960 | 65965 | 65966 | 65967 | 65968 | 65969 | 65970 | 65972 | 65984 | 65985 | 65986 | 65987 | 66058 | 66059 | 66060 | 66061 | 66062 | 66063 | 66433 | 66434 | 66435 | 66436 | 66437 | 66438