Attachment 66068 Details for Bug 16069 – Bug 16069 - XSS issue in basket.pl page

[patch] Bug 16069 - XSS issue in basket.pl page

Bug-16069---XSS-issue-in-basketpl-page.patch (text/plain), 3.86 KB, created by Marcel de Rooy on 2017-08-16 11:36:02 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2017-08-16 11:36:02 UTC

Size: 3.86 KB

patch

obsolete

>From 6c342ebe83cedbd5e9c90554a820eb4242c79430 Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Tue, 15 Aug 2017 22:58:02 +0530
>Subject: [PATCH] Bug 16069 - XSS issue in basket.pl page
>Content-Type: text/plain; charset=utf-8
>
>1. Hit /cgi-bin/koha/acqui/basket.pl?basketno=xx<script>alert('amit')</script>
>   xx - is a basketno
>2. Notice the java script is executed.
>3. Apply patch.
>4. Reload page, and hit the page again /cgi-bin/koha/acqui/basket.pl?basketno==xx<script>alert('amit')</script>
>   xx - is a basketno.
>5. Notice it is no longer executed.
>
>Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>---
> koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
>index 8cd4c88..aea00a3 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
>@@ -18,7 +18,7 @@
> [% USE AuthorisedValues %]
> 
> [% INCLUDE 'doc-head-open.inc' %]
>-<title>Koha &rsaquo; Acquisitions &rsaquo; [% UNLESS ( basketno ) %]New [% END %]Basket [% basketname|html %] ([% basketno %]) for [% name|html %]</title>
>+<title>Koha &rsaquo; Acquisitions &rsaquo; [% UNLESS ( basketno ) %]New [% END %]Basket [% basketname|html %] ([% basketno |html %]) for [% name|html %]</title>
> <link rel="stylesheet" type="text/css" href="[% interface %]/[% theme %]/css/datatables.css" />
> [% INCLUDE 'doc-head-close.inc' %]
> [% INCLUDE 'datatables.inc' %]
>@@ -82,7 +82,7 @@
>             function confirm_ediorder() {
>                 var is_confirmed = confirm(_("Are you sure you want to close this basket and generate an EDIFACT order?"));
>                 if (is_confirmed) {
>-                    window.location = "/cgi-bin/koha/acqui/basket.pl?op=edi_confirm&basketno=[% basketno %]";
>+                    window.location = "/cgi-bin/koha/acqui/basket.pl?op=edi_confirm&basketno=[% basketno |html %]";
>                 }
>             }
> 
>@@ -107,7 +107,7 @@
>                 var skip = [% IF ( skip_confirm_reopen ) %] 1 [% ELSE %] 0 [% END %];
>                 var is_confirmed = skip || confirm(_("Are you sure you want to reopen this basket?"));
>                 if (is_confirmed) {
>-                    window.location = "/cgi-bin/koha/acqui/basket.pl?op=reopen&basketno=[% basketno %]";
>+                    window.location = "/cgi-bin/koha/acqui/basket.pl?op=reopen&basketno=[% basketno |html %]";
>                 }
>             }
> //]]>
>@@ -197,7 +197,7 @@
>     <a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo;
>     <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo;
>     <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% name|html %]</a> &rsaquo;
>-    [% UNLESS ( basketno ) %][% IF ( delete_confirmed ) %]Deleted [% ELSE %]New [% END %][% END %]Basket [% basketname|html %] [% IF ( basketno ) %]([% basketno %])[% END %] for [% name|html %]
>+    [% UNLESS ( basketno ) %][% IF ( delete_confirmed ) %]Deleted [% ELSE %]New [% END %][% END %]Basket [% basketname|html %] [% IF ( basketno ) %]([% basketno |html %])[% END %] for [% name|html %]
> </div>
> 
> <div id="doc3" class="yui-t2">
>@@ -361,7 +361,7 @@
>                 [% END %]
>             </div>
>         [% END %]
>-        <h1>[% UNLESS ( basketno ) %]New [% END %]Basket [% basketname|html %] ([% basketno %]) for <a href="supplier.pl?booksellerid=[% booksellerid %]">[% name|html %]</a></h1>
>+        <h1>[% UNLESS ( basketno ) %]New [% END %]Basket [% basketname|html %] ([% basketno |html %]) for <a href="supplier.pl?booksellerid=[% booksellerid %]">[% name|html %]</a></h1>
>         [% IF ( basketno ) %]
>             <div id="acqui_basket_summary" class="yui-g">
>                 <div class="rows">
>-- 
>2.1.4

Actions: View | Diff | Splinter Review

Attachments on bug 16069: 65919 | 65931 | 65940 | 66032 | 66049 | 66068 | 66243