Bugzilla – Attachment 69109 Details for
Bug 19613
Scrub borrowers fields: borrowernotes opacnote
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 19613 - Fix XSS in /cgi-bin/koha/circ/circulation.pl
Bug-19613---Fix-XSS-in-cgi-binkohacirccirculationp.patch (text/plain), 1.22 KB, created by
Chris Cormack
on 2017-11-13 05:51:23 UTC
(
hide
)
Description:
Bug 19613 - Fix XSS in /cgi-bin/koha/circ/circulation.pl
Filename:
MIME Type:
Creator:
Chris Cormack
Created:
2017-11-13 05:51:23 UTC
Size:
1.22 KB
patch
obsolete
>From c1f3aa2f1492267c9b5f4118d744d3f45f4764bb Mon Sep 17 00:00:00 2001 >From: Amit Gupta <amit.gupta@informaticsglobal.com> >Date: Mon, 13 Nov 2017 09:16:30 +0530 >Subject: [PATCH] Bug 19613 - Fix XSS in /cgi-bin/koha/circ/circulation.pl > >To Test >1. Hit the page /cgi-bin/koha/members/memberentry.pl >2. Add a text in the field opacnote that contains js >3. Save the page. >4. Notice js is execute >5. Apply patch and reload, the js is escaped > >Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> >--- > koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt >index d5507c0f39..8d9fcd0cd3 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt >@@ -885,7 +885,7 @@ No patron matched <span class="ex">[% message | html %]</span> > [% IF ( notes ) %] > <div id="circnotes" class="circmessage"> > <h4>Notes:</h4> >- <p><span class="circ-hlt">[% notesmsg %]</span></p> >+ <p><span class="circ-hlt">[% notesmsg |html %]</span></p> > </div> > > >-- >2.14.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 19613
:
69104
|
69109
|
163194
|
163498
|
163585
|
163586
|
164211
|
164212