From be1a47dd92160cc46b1d922cc4637f073a3f28af Mon Sep 17 00:00:00 2001 From: David Cook Date: Mon, 18 Nov 2024 04:46:31 +0000 Subject: [PATCH] Bug 38469: Replace single quotes with double quotes to prevent XSS Content-Type: text/plain; charset=utf-8 This change replaces single quotes with double quotes to prevent XSS for particular operations on the circ returns page. Test plan: 0. Apply the patch 1. Go to http://localhost:8081/cgi-bin/koha/circ/returns.pl?print_slip=1&reserve_id=1 2. Note that a pring slip is generated (you may need to allow popups) 3. To test the XSS is patched, try the proof-of-concept from the bug report Signed-off-by: Victor Grousset/tuxayo Signed-off-by: Baptiste Wojtkowski Signed-off-by: Marcel de Rooy --- koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt index 39c7500712..618519e9f3 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt @@ -1515,10 +1515,10 @@ [% IF reserve_id %] $(".print-slip").on('click', function(e) { e.preventDefault(); - Dopop('hold-transfer-slip.pl?reserve_id=[% reserve_id | uri %]'); + Dopop("hold-transfer-slip.pl?reserve_id=[% reserve_id | uri %]"); }); [% IF print_slip %] - Dopop('hold-transfer-slip.pl?reserve_id=[% reserve_id | uri %]'); + Dopop("hold-transfer-slip.pl?reserve_id=[% reserve_id | uri %]"); [% END %] [% END %] var table_settings = [% TablesSettings.GetTableSettings( 'circ', 'returns', 'checkedintable', 'json' ) | $raw %] -- 2.39.5