Attachment 69661 Details for Bug 19614 – Bug 19614: Fix XSS in members/pay.pl

[patch] Bug 19614: Fix XSS in members/pay.pl

Bug-19614-Fix-XSS-in-memberspaypl.patch (text/plain), 2.39 KB, created by Jonathan Druart on 2017-12-08 18:05:30 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2017-12-08 18:05:30 UTC

Size: 2.39 KB

patch

obsolete

>From dbbf1b5b925dc5425028306c69482d57f93087cd Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Mon, 13 Nov 2017 09:27:44 +0530
>Subject: [PATCH] Bug 19614: Fix XSS in members/pay.pl
>
>To Test
>1. Hit the page /cgi-bin/koha/members/memberentry.pl
>2. Add a text in the field firstname, surname that contains js
>3. Save the page.
>4. click on fine tab
>5. Notice js is execute
>6. Apply patch and reload, the js is escaped
>
>Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
>
>Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
>
>Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>---
> koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
>index ead4ce4cb9..f40bae7216 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
>@@ -3,7 +3,7 @@
> [% USE Branches %]
> [% USE Price %]
> [% INCLUDE 'doc-head-open.inc' %]
>-<title>Koha &rsaquo; Patrons &rsaquo; Pay Fines for  [% borrower.firstname %] [% borrower.surname %]</title>
>+<title>Koha &rsaquo; Patrons &rsaquo; Pay Fines for  [% borrower.firstname |html %] [% borrower.surname |html %]</title>
> [% INCLUDE 'doc-head-close.inc' %]
> <script type="text/javascript" src="[% interface %]/lib/jquery/plugins/jquery.checkboxes.min.js"></script>
> <script type= "text/javascript">
>@@ -48,7 +48,7 @@ function enableCheckboxActions(){
> [% INCLUDE 'header.inc' %]
> [% INCLUDE 'patron-search.inc' %]
> 
>-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>  &rsaquo; Pay fines for [% borrower.firstname %] [% borrower.surname %]</div>
>+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>  &rsaquo; Pay fines for [% borrower.firstname |html %] [% borrower.surname |html %]</div>
> 
> <div id="doc3" class="yui-t2">
>    
>@@ -169,7 +169,7 @@ function enableCheckboxActions(){
> </fieldset>
> </form>
> [% ELSE %]
>-    <p>[% borrower.firstname %] [% borrower.surname %] has no outstanding fines.</p>
>+    <p>[% borrower.firstname |html %] [% borrower.surname |html %] has no outstanding fines.</p>
> [% END %]
> </div></div>
> 
>-- 
>2.11.0

Actions: View | Diff | Splinter Review

Attachments on bug 19614: 69105 | 69110 | 69468 | 69661