From d57887a2a88e7b7c4a93d28b8340762d65fe1f08 Mon Sep 17 00:00:00 2001 From: David Cook Date: Tue, 29 Jul 2025 04:07:37 +0000 Subject: [PATCH] Bug 40538: Fix XSS in suspend hold modal This patch fixes a XSS vulnerability in the suspend hold modal in the staff interface. By building our Javascript using Web APIs rather than with strings and jQuery's html() method, we're able to securely handle malicious payloads. Test plan: 0. Apply the patch 1. Go to http://localhost:8081/cgi-bin/koha/reserve/request.pl?biblionumber=29 2. Add a hold for "koha" patron 3. Go to http://localhost:8081/cgi-bin/koha/circ/circulation.pl?borrowernumber=51 4. Click "Holds" tab and click "Suspend" 5. Note the modal loads properly 6. Go to http://localhost:8081/cgi-bin/koha/members/moremember.pl?borrowernumber=51 7. Click "Holds" tab and click "Suspend" 8. Note the modal loads properly --- koha-tmpl/intranet-tmpl/prog/js/holds.js | 33 +++++++++++++++++------- 1 file changed, 23 insertions(+), 10 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/js/holds.js b/koha-tmpl/intranet-tmpl/prog/js/holds.js index 752e0f5b6a..23e5d61973 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/holds.js +++ b/koha-tmpl/intranet-tmpl/prog/js/holds.js @@ -373,16 +373,29 @@ $(document).ready(function () { "" ); } else { - return ( - "" + - " " + - __("Suspend") + - "" + const link = document.createElement("a"); + link.classList.add( + "hold-suspend", + "btn", + "btn-default", + "btn-xs" + ); + link.setAttribute( + "data-hold-id", + oObj.reserve_id + ); + link.setAttribute( + "data-hold-title", + oObj.title + ); + link.textContent = " " + __("Suspend"); + const icon = document.createElement("i"); + icon.classList.add("fa", "fa-pause"); + link.insertAdjacentElement( + "afterbegin", + icon ); + return link.outerHTML; } }, }, @@ -491,7 +504,7 @@ $(document).ready(function () { $(".hold-suspend").on("click", function () { var hold_id = $(this).data("hold-id"); var hold_title = $(this).data("hold-title"); - $("#suspend-modal-title").html(hold_title); + $("#suspend-modal-title").text(hold_title); $("#suspend-modal-submit").data("hold-id", hold_id); $("#suspend-modal").modal("show"); }); -- 2.39.5