From c07bec37b3595d62ce4a1b807a5ae6727e8be36c Mon Sep 17 00:00:00 2001 From: David Cook Date: Mon, 18 Nov 2024 05:15:26 +0000 Subject: [PATCH] Bug 38470: Add missing double quotes to some Javascript This change adds some double quotes where quotes were missing, and replaces single quotes with double quotes, which prevents XSS. Test plan: 0. Apply the patch 1. Create a subscription 2. Using the ID from the subscription, go to this page: http://localhost:8081/cgi-bin/koha/serials/subscription-detail.pl? print_routing_list_issue=1&subscriptionid= 3. Note that you're able to generate a print slip (You may need to allow popups) 4. To check the security vulnerability is fixed, try the proof-of-concepts attached to the bug report Signed-off-by: Victor Grousset/tuxayo Signed-off-by: Julian Maurice --- .../prog/en/modules/serials/subscription-detail.tt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt index 5c70b04238..53b43ff26e 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt @@ -452,7 +452,7 @@ $(document).ready(function() { $("#renewsub").click(function(){ - popup([% subscriptionid | html %]); + popup("[% subscriptionid | html %]"); return false; }) @@ -498,7 +498,7 @@ $("#show_all_orders").click(); [% IF print_routing_list_issue %] - var myurl = '/cgi-bin/koha/serials/routing-preview.pl?op=print&subscriptionid=[% subscriptionid | uri %]&issue=[% print_routing_list_issue | uri %]'; + var myurl = "/cgi-bin/koha/serials/routing-preview.pl?op=print&subscriptionid=[% subscriptionid | uri %]&issue=[% print_routing_list_issue | uri %]"; window.open(myurl,'PrintSlip','width=500,height=500,toolbar=no,scrollbars=yes'); [% END %] -- 2.39.2