Bugzilla – Attachment 66085 Details for
Bug 19108
Stored XSS in multiple scripts
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 19108 - Follow-up - fieldmapping.tt and items_search_fields.tt
Bug-19108---Follow-up---fieldmappingtt-and-itemsse.patch (text/plain), 3.87 KB, created by
Katrin Fischer
on 2017-08-16 11:55:25 UTC
(
hide
)
Description:
Bug 19108 - Follow-up - fieldmapping.tt and items_search_fields.tt
Filename:
MIME Type:
Creator:
Katrin Fischer
Created:
2017-08-16 11:55:25 UTC
Size:
3.87 KB
patch
obsolete
>From 72113549221d21d0437a4c71922903d4b4cf2dfb Mon Sep 17 00:00:00 2001 >From: Katrin Fischer <katrin.fischer.83@web.de> >Date: Wed, 16 Aug 2017 13:52:07 +0200 >Subject: [PATCH] Bug 19108 - Follow-up - fieldmapping.tt and > items_search_fields.tt > >To test: >- Add a framework with script in the description >- Access the Keywords to MARC mapping page >- Add an item search field where both name and label are script >- Try to edit/delete the added mapping > >With the patch no script should be executed and everything >should still work ok. >--- > koha-tmpl/intranet-tmpl/prog/en/modules/admin/fieldmapping.tt | 6 +++--- > .../intranet-tmpl/prog/en/modules/admin/items_search_fields.tt | 4 ++-- > 2 files changed, 5 insertions(+), 5 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/fieldmapping.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/fieldmapping.tt >index 5dcfc6c..6bcbfe2 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/fieldmapping.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/fieldmapping.tt >@@ -25,7 +25,7 @@ $(document).ready(function() { > <div class="yui-b"> > <h2>Keyword to MARC mapping</h2> > [% UNLESS ( fields.count ) %] >- <div class="dialog message"><p>There are no mappings for the [% IF framework.frameworktext %]<em>[% framework.frameworktext %]</em>[% ELSE %]default[% END %] framework. </p></div> >+ <div class="dialog message"><p>There are no mappings for the [% IF framework.frameworktext %]<em>[% framework.frameworktext |html %]</em>[% ELSE %]default[% END %] framework. </p></div> > [% END %] > <form method="get" action="/cgi-bin/koha/admin/fieldmapping.pl" id="selectframework"> > <label for="framework">Framework:</label> >@@ -33,9 +33,9 @@ $(document).ready(function() { > <option value="">Default</option> > [% FOREACH f IN frameworks %] > [% IF f.frameworkcode == framework.frameworkcode %] >- <option selected="selected" value="[% f.frameworkcode %]">[% f.frameworktext %]</option> >+ <option selected="selected" value="[% f.frameworkcode %]">[% f.frameworktext |html %]</option> > [% ELSE %] >- <option value="[% f.frameworkcode %]">[% f.frameworktext %]</option> >+ <option value="[% f.frameworkcode %]">[% f.frameworktext |html %]</option> > [% END %] > [% END %] > </select> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_fields.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_fields.tt >index 0904553..6e12b1b 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_fields.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_fields.tt >@@ -77,8 +77,8 @@ > <td>[% field.tagsubfield %]</td> > <td>[% field.authorised_values_category %]</td> > <td> >- <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/items_search_field.pl?name=[% field.name %]" title="Edit [% field.name %] field"><i class="fa fa-pencil"></i> Edit</a> >- <a class="field-delete btn btn-default btn-xs" href="/cgi-bin/koha/admin/items_search_fields.pl?op=del&name=[% field.name %]"><i class="fa fa-trash"></i> Delete</a> >+ <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/items_search_field.pl?name=[% field.name |html %]" title="Edit [% field.name |html %] field"><i class="fa fa-pencil"></i> Edit</a> >+ <a class="field-delete btn btn-default btn-xs" href="/cgi-bin/koha/admin/items_search_fields.pl?op=del&name=[% field.name |html %]"><i class="fa fa-trash"></i> Delete</a> > </td> > </tr> > [% END %] >-- >2.7.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 19108
:
65997
|
65998
|
65999
|
66000
|
66001
|
66002
|
66079
|
66080
|
66081
|
66082
|
66083
|
66084
|
66085
|
66442
|
66443
|
66444
|
66445
|
66446
|
66447
|
66448
|
67085