Bugzilla – Attachment 66033 Details for
Bug 19100
XSS Flaws in memberentry.pl
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 19100 - XSS Flaws in memberentry.pl
0001-Bug-19100-XSS-Flaws-in-memberentry.pl.patch (text/plain), 1.56 KB, created by
Amit Gupta
on 2017-08-15 17:54:45 UTC
(
hide
)
Description:
Bug 19100 - XSS Flaws in memberentry.pl
Filename:
MIME Type:
Creator:
Amit Gupta
Created:
2017-08-15 17:54:45 UTC
Size:
1.56 KB
patch
obsolete
>From b6c6eff5fb426d7b7f3e438253bb51d605776fcd Mon Sep 17 00:00:00 2001 >From: Amit Gupta <amit.gupta@informaticsglobal.com> >Date: Tue, 15 Aug 2017 23:22:32 +0530 >Subject: [PATCH] Bug 19100 - XSS Flaws in memberentry.pl > >1. Hit /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script> > xx - is a guarantorid >2. Notice the java script is executed. >3. Apply patch. >4. Reload page, and hit the page again /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script> > xx - is a guarantorid. >5. Notice it is no longer executed. >--- > .../prog/en/modules/members/memberentrygen.tt | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt >index 7f6f734..af75832 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt >@@ -413,7 +413,7 @@ $(document).ready(function() { > [% ELSE %] > <li id="contact-details" style="display: none"> > [% END %] >- <span class="label">Patron #:</span> [% IF ( guarantorid ) %] <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% guarantorid %]" target="blank">[% guarantorid %]</a>[% END %] >+ <span class="label">Patron #:</span> [% IF ( guarantorid ) %] <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% guarantorid %]" target="blank">[% guarantorid |html %]</a>[% END %] > </li> > [% UNLESS nocontactname %] > <li> >-- >1.7.9.5 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 19100
:
65971
|
66033
|
66035
|
66065