Attachment 66243 Details for Bug 16069 – [16.11.x] Bug 16069 - XSS issue in basket.pl page

[patch] [16.11.x] Bug 16069 - XSS issue in basket.pl page

0001-Bug-16069-XSS-issue-in-basket.pl-page.patch (text/plain), 3.85 KB, created by Amit Gupta on 2017-08-20 15:24:41 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Amit Gupta

Created: 2017-08-20 15:24:41 UTC

Size: 3.85 KB

patch

obsolete

>From 0f465b505c2d573b8cf478556ebc44eebd706344 Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Sun, 20 Aug 2017 20:53:06 +0530
>Subject: [PATCH] Bug 16069 - XSS issue in basket.pl page
>
>1. Hit /cgi-bin/koha/acqui/basket.pl?basketno=xx<script>alert('amit')</script>
>   xx - is a basketno
>2. Notice the java script is executed.
>3. Apply patch.
>4. Reload page, and hit the page again /cgi-bin/koha/acqui/basket.pl?basketno==xx<script>alert('amit')</script>
>   xx - is a basketno.
>5. Notice it is no longer executed.
>
>Fix for 16.11.x
>---
> koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
>index 2695796..109c9eb 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
>@@ -4,7 +4,7 @@
> [% USE AuthorisedValues %]
> 
> [% INCLUDE 'doc-head-open.inc' %]
>-<title>Koha &rsaquo; Acquisitions &rsaquo; [% UNLESS ( basketno ) %]New [% END %]Basket [% basketname|html %] ([% basketno %]) for [% name|html %]</title>
>+<title>Koha &rsaquo; Acquisitions &rsaquo; [% UNLESS ( basketno ) %]New [% END %]Basket [% basketname|html %] ([% basketno |html %]) for [% name|html %]</title>
> <link rel="stylesheet" type="text/css" href="[% interface %]/[% theme %]/css/datatables.css" />
> [% INCLUDE 'doc-head-close.inc' %]
> [% INCLUDE 'datatables.inc' %]
>@@ -68,7 +68,7 @@
>             function confirm_ediorder() {
>                 var is_confirmed = confirm(_("Are you sure you want to close this basket and generate an EDIFACT order?"));
>                 if (is_confirmed) {
>-                    window.location = "/cgi-bin/koha/acqui/basket.pl?op=edi_confirm&basketno=[% basketno %]";
>+                    window.location = "/cgi-bin/koha/acqui/basket.pl?op=edi_confirm&basketno=[% basketno |html %]";
>                 }
>             }
> 
>@@ -93,7 +93,7 @@
>                 var skip = [% IF ( skip_confirm_reopen ) %] 1 [% ELSE %] 0 [% END %];
>                 var is_confirmed = skip || confirm(_("Are you sure you want to reopen this basket?"));
>                 if (is_confirmed) {
>-                    window.location = "/cgi-bin/koha/acqui/basket.pl?op=reopen&basketno=[% basketno %]";
>+                    window.location = "/cgi-bin/koha/acqui/basket.pl?op=reopen&basketno=[% basketno |html %]";
>                 }
>             }
> //]]>
>@@ -167,7 +167,7 @@
> [% INCLUDE 'acquisitions-search.inc' %]
> 
> 
>-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% name|html %]</a> &rsaquo; [% UNLESS ( basketno ) %]New [% END %]Basket [% basketname|html %] ([% basketno %]) for [% name|html %]</div>
>+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% name|html %]</a> &rsaquo; [% UNLESS ( basketno ) %]New [% END %]Basket [% basketname|html %] ([% basketno |html %]) for [% name|html %]</div>
> 
> <div id="doc3" class="yui-t2">
> 
>@@ -317,7 +317,7 @@
>                 [% END %]
>             </div>
>         [% END %]
>-        <h1>[% UNLESS ( basketno ) %]New [% END %]Basket [% basketname|html %] ([% basketno %]) for <a href="supplier.pl?booksellerid=[% booksellerid %]">[% name|html %]</a></h1>
>+        <h1>[% UNLESS ( basketno ) %]New [% END %]Basket [% basketname|html %] ([% basketno |html %]) for <a href="supplier.pl?booksellerid=[% booksellerid %]">[% name|html %]</a></h1>
>         [% IF ( basketno ) %]
>             <div id="acqui_basket_summary" class="yui-g">
>                 <div class="rows">
>-- 
>2.7.4
>

Actions: View | Diff | Splinter Review

Attachments on bug 16069: 65919 | 65931 | 65940 | 66032 | 66049 | 66068 | 66243