From e04d61fd06c45736ff16699613cd8e1d4dc204ff Mon Sep 17 00:00:00 2001 From: Phil Ringnalda <phil@chetcolibrary.org> Date: Thu, 23 Jan 2025 18:01:12 -0800 Subject: [PATCH] Bug 38961: XSS in vendor search acqui/booksellers.tt and admin/currency.tt use | $HtmlTags without first filtering the string they wrap. Test plan: 1. Without the patch, load the URL in comment 1, note the alert() 2. Apply patch, load the URL in comment 1, no alert() Sponsored-by: Chetco Community Public Library --- koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt | 2 +- koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt index efd6a578fb7..4a05d1569fd 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt @@ -30,7 +30,7 @@ <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> [% END %] [% WRAPPER breadcrumb_item bc_active= 1 %] - <span>Search for vendor [% supplier | $HtmlTags tag='em' %]</span> + <span>Search for vendor [% supplier | html | $HtmlTags tag='em' %]</span> [% END %] [% END #/ WRAPPER breadcrumbs %] [% END #/ WRAPPER sub-header.inc %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt index cce27e7b6d5..14f2d9bc816 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt @@ -180,7 +180,7 @@ [% IF op =='delete_confirm' %] [% IF nb_of_orders or nb_of_vendors %] <div class="alert alert-warning"> - <h1>Cannot delete currency [% currency.currency | $HtmlTags tag='span' attributes=>'class="ex"' %]</h1> + <h1>Cannot delete currency [% currency.currency | html | $HtmlTags tag='span' attributes=>'class="ex"' %]</h1> <p> [% IF nb_of_orders %] <span>This currency is used by [% nb_of_orders | html %] orders.</span> -- 2.47.1