Bugzilla – Attachment 66062 Details for
Bug 19086
Multiple cross-site scripting vulnerabilities
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 19086 - Follow-up - XSS in supplier.tt
Bug-19086---Follow-up---XSS-in-suppliertt.patch (text/plain), 3.20 KB, created by
Katrin Fischer
on 2017-08-16 11:08:37 UTC
(
hide
)
Description:
Bug 19086 - Follow-up - XSS in supplier.tt
Filename:
MIME Type:
Creator:
Katrin Fischer
Created:
2017-08-16 11:08:37 UTC
Size:
3.20 KB
patch
obsolete
>From 16643d83da02d516efbdf3affb8920a806e7599c Mon Sep 17 00:00:00 2001 >From: Katrin Fischer <katrin.fischer.83@web.de> >Date: Wed, 16 Aug 2017 12:59:13 +0200 >Subject: [PATCH] Bug 19086 - Follow-up - XSS in supplier.tt > >In preparation: >Make sure you enter <script>alert("sth")</script> >in all fields of a new vendor that are not validated >and save. > >1) Access vendor summary page. >2) Verify scripts are executed >3) Apply patch >4) Verify scripts are on longer executed > >This works in combination with the other patches for XSS >on this bug. >--- > koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt | 10 +++++----- > 1 file changed, 5 insertions(+), 5 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt >index b0e127b..86e51e5 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt >@@ -57,7 +57,7 @@ > [% END %] > > [% BLOCK show_contact %] >- <h3>[% contact.name %]</h3> >+ <h3>[% contact.name |html %]</h3> > <p><span class="label">Position: </span>[% contact.position |html %]</p> > <p><span class="label">Phone: </span>[% contact.phone |html %]</p> > <p><span class="label">Alternative phone: </span>[% contact.altphone |html %]</p> >@@ -169,7 +169,7 @@ function delete_contact(ev) { > [% INCLUDE 'header.inc' %] > [% INCLUDE 'acquisitions-search.inc' %] > >-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> › <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> › [% IF ( enter ) %][% IF ( booksellerid ) %] <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% name %]</a> › Update: [% name %][% ELSE %]Add vendor[% END %] [% ELSE %][% name %][% END %]</div> >+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> › <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> › [% IF ( enter ) %][% IF ( booksellerid ) %] <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% name |html %]</a> › Update: [% name %][% ELSE %]Add vendor[% END %] [% ELSE %][% name |html %][% END %]</div> > > <div id="doc3" class="yui-t2"> > >@@ -178,7 +178,7 @@ function delete_contact(ev) { > <div class="yui-b"> > [% IF ( enter ) %] > [% IF ( booksellerid ) %] >- <h1>Update: [% name %]</h1> >+ <h1>Update: [% name |html %]</h1> > [% ELSE %] > <h1>Add vendor</h1> > [% END %] >@@ -318,11 +318,11 @@ function delete_contact(ev) { > </div> > </form> > [% ELSE %] >- <h1>[% name %]</h1> >+ <h1>[% name |html %]</h1> > <div class="yui-g"> > <div id="supplier-company-details" class="yui-u first"> > <h2>Vendor details</h2> >- <p><span class="label">Company name: </span>[% name %]</p> >+ <p><span class="label">Company name: </span>[% name |html %]</p> > <p><span class="label">Postal address: </span>[% postal |html %]</p> > <p><span class="label">Physical address: </span>[% address1 |html %][% address2 |html %][% address3 |html %][% address4 |html %]</p> > <p><span class="label">Phone: </span>[% phone |html %]</p> >-- >2.7.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 19086
:
65927
|
65929
|
65958
|
65960
|
65965
|
65966
|
65967
|
65968
|
65969
|
65970
|
65972
|
65984
|
65985
|
65986
|
65987
|
66058
|
66059
|
66060
|
66061
|
66062
|
66063
|
66433
|
66434
|
66435
|
66436
|
66437
|
66438