From 23ddf221399136e87871beda89787fd1cbe01674 Mon Sep 17 00:00:00 2001 From: Phil Ringnalda Date: Thu, 23 Jan 2025 18:01:12 -0800 Subject: [PATCH] Bug 38961: XSS in vendor search acqui/booksellers.tt and admin/currency.tt use | $HtmlTags without first filtering the string they wrap. Test plan: 1. Without the patch, load the URL in comment 1, note the alert() 2. Apply patch, load the URL in comment 1, no alert() Sponsored-by: Chetco Community Public Library Signed-off-by: Magnus Enger Followed the test plan, works as advertised. --- koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt | 2 +- koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt index efd6a578fb7..4a05d1569fd 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt @@ -30,7 +30,7 @@ Acquisitions [% END %] [% WRAPPER breadcrumb_item bc_active= 1 %] - Search for vendor [% supplier | $HtmlTags tag='em' %] + Search for vendor [% supplier | html | $HtmlTags tag='em' %] [% END %] [% END #/ WRAPPER breadcrumbs %] [% END #/ WRAPPER sub-header.inc %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt index cce27e7b6d5..14f2d9bc816 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt @@ -180,7 +180,7 @@ [% IF op =='delete_confirm' %] [% IF nb_of_orders or nb_of_vendors %]
-

Cannot delete currency [% currency.currency | $HtmlTags tag='span' attributes=>'class="ex"' %]

+

Cannot delete currency [% currency.currency | html | $HtmlTags tag='span' attributes=>'class="ex"' %]

[% IF nb_of_orders %] This currency is used by [% nb_of_orders | html %] orders. -- 2.34.1