From 2dd6ab1553294236019289362bfdf033cfce6346 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Wed, 10 Jan 2024 13:56:15 +0100 Subject: [PATCH] Bug 35329: Prevent XSS Signed-off-by: Owen Leonard Signed-off-by: Martin Renvoize --- koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc | 4 ++-- koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt | 2 +- .../intranet-tmpl/prog/en/modules/acqui/neworderempty.tt | 2 +- koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt | 4 ++-- .../intranet-tmpl/prog/en/modules/suggestion/suggestion.tt | 6 +++--- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc index 89ea5874d5a..dbddb606603 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc @@ -882,9 +882,9 @@ parent_block.find(".info").hide(); parent_block.find(".error").hide(); if ( add_user(borrowernumber, borrowername) < 0 ) { - parent_block.find(".error").html(_("Patron '%s' is already in the list.").format(borrowername)).show(); + parent_block.find(".error").html(_("Patron '%s' is already in the list.").format(borrowername.escapeHtml())).show(); } else { - parent_block.find(".info").html(_("Patron '%s' added.").format(borrowername)).show(); + parent_block.find(".info").html(_("Patron '%s' added.").format(borrowername.escapeHtml())).show(); } } function modal_select_user(borrowernumber, data) { diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt index a3c9fa9c88f..9e121815da7 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt @@ -1167,7 +1167,7 @@ if (ids.indexOf(borrowernumber.toString()) < 0) { ids.push(borrowernumber); $("#users_ids").val(ids.join(':')); - var li = '
  • '+borrowername + var li = '
  • '+borrowername.escapeHtml() + ' ' + _("Delete user") + '
  • '; $("#users_names").prepend(li); diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt index 76cdc1a3b9a..d6426663610 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt @@ -209,7 +209,7 @@ if (ids.indexOf(borrowernumber.toString()) < 0) { ids.push(borrowernumber); $("#users_ids").val(ids.join(':')); - var li = '
  • '+borrowername + var li = '
  • '+borrowername.escapeHtml() + ' [' + _("Delete user") + ']
  • '; $("#users_names").append(li); diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt index 44528bddffa..2572ba3c988 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt @@ -547,7 +547,7 @@ if (borrowernumber) { var ownerlink = '' - + borrowername + ''; + + borrowername.escapeHtml() + ''; $('#budget_owner_name').html(ownerlink); $('#budget_owner_id').val(borrowernumber); } @@ -563,7 +563,7 @@ if(borrowernumber && ids.indexOf(borrowernumber.toString()) == -1) { var li = '
  • ' + '' + borrowername + ' ' + + borrowernumber + '">' + borrowername.escapeHtml() + ' ' + ' • '+_("Remove")+' ' + '
  • '; $("#budget_users").prepend(li); diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt index 8d657bbe9a4..d0af6e8efcf 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt @@ -1262,7 +1262,7 @@ if (borrowernumber) { var managerlink = '' - + borrowername + ''; + + borrowername.escapeHtml() + ''; managedby_name.html(managerlink); managedby.val(borrowernumber); } @@ -1293,9 +1293,9 @@ success: function (data) { var suggested = ''; suggested += ''; - suggested += data.surname + ', ' + data.firstname + ' (' + data.cardnumber + ')'; + suggested += data.surname.escapeHtml() + ', ' + data.firstname.escapeHtml() + ' (' + data.cardnumber.escapeHtml() + ')'; suggested += ' '; - suggested += data._strings.library_id.str + ' (' + data._strings.category_id.str + ')'; + suggested += data._strings.library_id.str.escapeHtml() + ' (' + data._strings.category_id.str.escapeHtml() + ')'; $("#tdsuggestedby").html(suggested); }, -- 2.43.0