Attachment 69104 Details for Bug 19613 – Bug 19613 - Fix XSS in /cgi-bin/koha/circ/circulation.pl

[patch] Bug 19613 - Fix XSS in /cgi-bin/koha/circ/circulation.pl

0001-Bug-19613-Fix-XSS-in-cgi-bin-koha-circ-circulation.p.patch (text/plain), 1.16 KB, created by Amit Gupta on 2017-11-13 03:48:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Amit Gupta

Created: 2017-11-13 03:48:22 UTC

Size: 1.16 KB

patch

obsolete

>From 2f39d0025ca395e88ac6911a385d32ff9f6adcab Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Mon, 13 Nov 2017 09:16:30 +0530
>Subject: [PATCH] Bug 19613 - Fix XSS in /cgi-bin/koha/circ/circulation.pl
>
>To Test
>1. Hit the page /cgi-bin/koha/members/memberentry.pl
>2. Add a text in the field opacnote that contains js
>3. Save the page.
>4. Notice js is execute
>5. Apply patch and reload, the js is escaped
>---
> koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
>index d5507c0..8d9fcd0 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
>@@ -885,7 +885,7 @@ No patron matched <span class="ex">[% message | html %]</span>
> 	[% IF ( notes ) %]
> 			<div id="circnotes" class="circmessage">
> 			<h4>Notes:</h4>
>-            <p><span class="circ-hlt">[% notesmsg %]</span></p>
>+            <p><span class="circ-hlt">[% notesmsg |html %]</span></p>
> 			</div>
> 
> 
>-- 
>2.7.4
>

Actions: View | Diff | Splinter Review

Attachments on bug 19613: 69104 | 69109 | 163194 | 163498 | 163585 | 163586 | 164211 | 164212