Attachment 69110 Details for Bug 19614 – Bug 19614 - Fix XSS in /cgi-bin/koha/members/pay.pl

[patch] Bug 19614 - Fix XSS in /cgi-bin/koha/members/pay.pl

Bug-19614---Fix-XSS-in-cgi-binkohamemberspaypl.patch (text/plain), 2.27 KB, created by Chris Cormack on 2017-11-13 05:54:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Cormack

Created: 2017-11-13 05:54:28 UTC

Size: 2.27 KB

patch

obsolete

>From 07f664ef615b19cf548866664f9d89a94707793e Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Mon, 13 Nov 2017 09:27:44 +0530
>Subject: [PATCH] Bug 19614 - Fix XSS in /cgi-bin/koha/members/pay.pl
>
>To Test
>1. Hit the page /cgi-bin/koha/members/memberentry.pl
>2. Add a text in the field firstname, surname that contains js
>3. Save the page.
>4. click on fine tab
>5. Notice js is execute
>6. Apply patch and reload, the js is escaped
>
>Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
>---
> koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
>index ead4ce4cb9..f40bae7216 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
>@@ -3,7 +3,7 @@
> [% USE Branches %]
> [% USE Price %]
> [% INCLUDE 'doc-head-open.inc' %]
>-<title>Koha &rsaquo; Patrons &rsaquo; Pay Fines for  [% borrower.firstname %] [% borrower.surname %]</title>
>+<title>Koha &rsaquo; Patrons &rsaquo; Pay Fines for  [% borrower.firstname |html %] [% borrower.surname |html %]</title>
> [% INCLUDE 'doc-head-close.inc' %]
> <script type="text/javascript" src="[% interface %]/lib/jquery/plugins/jquery.checkboxes.min.js"></script>
> <script type= "text/javascript">
>@@ -48,7 +48,7 @@ function enableCheckboxActions(){
> [% INCLUDE 'header.inc' %]
> [% INCLUDE 'patron-search.inc' %]
> 
>-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>  &rsaquo; Pay fines for [% borrower.firstname %] [% borrower.surname %]</div>
>+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>  &rsaquo; Pay fines for [% borrower.firstname |html %] [% borrower.surname |html %]</div>
> 
> <div id="doc3" class="yui-t2">
>    
>@@ -169,7 +169,7 @@ function enableCheckboxActions(){
> </fieldset>
> </form>
> [% ELSE %]
>-    <p>[% borrower.firstname %] [% borrower.surname %] has no outstanding fines.</p>
>+    <p>[% borrower.firstname |html %] [% borrower.surname |html %] has no outstanding fines.</p>
> [% END %]
> </div></div>
> 
>-- 
>2.14.1

Actions: View | Diff | Splinter Review

Attachments on bug 19614: 69105 | 69110 | 69468 | 69661