Bugzilla – Attachment 69216 Details for
Bug 19611
XSS Flaws in supplier.pl
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 19611 - XSS Flaws in supplier.pl
Bug-19611---XSS-Flaws-in-supplierpl.patch (text/plain), 2.87 KB, created by
Katrin Fischer
on 2017-11-19 21:08:38 UTC
(
hide
)
Description:
Bug 19611 - XSS Flaws in supplier.pl
Filename:
MIME Type:
Creator:
Katrin Fischer
Created:
2017-11-19 21:08:38 UTC
Size:
2.87 KB
patch
obsolete
>From 772bee6db94eb0313d52cbda19455fd27992e71e Mon Sep 17 00:00:00 2001 >From: Amit Gupta <amit.gupta@informaticsglobal.com> >Date: Sun, 12 Nov 2017 21:14:41 +0530 >Subject: [PATCH] Bug 19611 - XSS Flaws in supplier.pl > >Test >1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter >2. Add a text in the field Name that contains java script >3. Save the page. >4. Notice js is execute >5. Apply patch and reload the js is escaped > >Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> >--- > koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt | 2 +- > koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt >index e8acf39696..43b43a2bfa 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt >@@ -100,7 +100,7 @@ $(document).ready(function() { > [% END %] > <span class="suppliername"> > [% IF (supplier.name) %] >- <a name="[% supplier.booksellerid %]" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% supplier.booksellerid %]">[% supplier.name %]</a> >+ <a name="[% supplier.booksellerid %]" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% supplier.booksellerid %]">[% supplier.name |html %]</a> > [% ELSE %] > <a name="[% supplier.booksellerid %]" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% supplier.booksellerid %]">NO NAME</a> > [% END %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt >index 085875f4f2..07954a39af 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt >@@ -169,7 +169,7 @@ function delete_contact(ev) { > [% INCLUDE 'header.inc' %] > [% INCLUDE 'acquisitions-search.inc' %] > >-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> › <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> › [% IF ( enter ) %][% IF ( booksellerid ) %] <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% name |html %]</a> › Update: [% name %][% ELSE %]Add vendor[% END %] [% ELSE %][% name |html %][% END %]</div> >+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> › <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> › [% IF ( enter ) %][% IF ( booksellerid ) %] <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% name |html %]</a> › Update: [% name |html %][% ELSE %]Add vendor[% END %] [% ELSE %][% name |html %][% END %]</div> > > <div id="doc3" class="yui-t2"> > >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 19611
:
69099
|
69216
|
69472
|
69659