Attachment 66436 Details for Bug 19086 – Bug 19086 Stored XSS in subscription-add.pl

[patch] Bug 19086 Stored XSS in subscription-add.pl

Bug-19086-Stored-XSS-in-subscription-addpl.patch (text/plain), 2.02 KB, created by Marcel de Rooy on 2017-08-25 06:13:18 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2017-08-25 06:13:18 UTC

Size: 2.02 KB

patch

obsolete

>From b693a588ee93e382aa8531f590f536bb82395623 Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Tue, 15 Aug 2017 02:44:11 +0530
>Subject: [PATCH] Bug 19086 Stored XSS in subscription-add.pl
>Content-Type: text/plain; charset=utf-8
>
>To Test
>1. Hit the page /cgi-bin/koha/serials/subscription-add.pl
>2. Add a text in the field Public note and Nonpublic note
> that contains js (Internalnotes, notes)
>2. Save the page.
>3. Notice js is execute
>4. Apply patch and reload, the js is escaped
>
>Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>---
> .../intranet-tmpl/prog/en/modules/serials/subscription-detail.tt | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt
>index 8c95459..a943120 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt
>@@ -339,8 +339,8 @@ $(document).ready(function() {
> <li>History end date: [% histenddate %]</li>
> <li>Received issues:[% recievedlist %]</li>
> <li>Missing issues:[% missinglist %]</li>
>- <li>Nonpublic note:[% internalnotes FILTER html_line_break %]</li>
>- <li>Public note:[% notes FILTER html_line_break %]</li>
>+ <li>Nonpublic note:[% internalnotes FILTER html_line_break |html %]</li>
>+ <li>Public note:[% notes FILTER html_line_break |html %]</li>
> <li>History staff note:[% librariannote FILTER html_line_break %]</li>
> <li>History OPAC note:[% opacnote FILTER html_line_break %]</li>
> </ol>
>-- 
>2.1.4

Actions: View | Diff | Splinter Review

Attachments on bug 19086: 65927 | 65929 | 65958 | 65960 | 65965 | 65966 | 65967 | 65968 | 65969 | 65970 | 65972 | 65984 | 65985 | 65986 | 65987 | 66058 | 66059 | 66060 | 66061 | 66062 | 66063 | 66433 | 66434 | 66435 | 66436 | 66437 | 66438