From bd142cae05ff361392955248bc091700e5efed75 Mon Sep 17 00:00:00 2001 From: David Cook Date: Tue, 29 Jul 2025 04:07:37 +0000 Subject: [PATCH] Bug 40538: Fix XSS in suspend hold modal This patch fixes a XSS vulnerability in the suspend hold modal in the staff interface. By building our Javascript using Web APIs rather than with strings and jQuery's html() method, we're able to securely handle malicious payloads. Test plan: 0. Apply the patch 1. Go to http://localhost:8081/cgi-bin/koha/reserve/request.pl?biblionumber=29 2. Add a hold for "koha" patron 3. Go to http://localhost:8081/cgi-bin/koha/circ/circulation.pl?borrowernumber=51 4. Click "Holds" tab and click "Suspend" 5. Note the modal loads properly 6. Go to http://localhost:8081/cgi-bin/koha/members/moremember.pl?borrowernumber=51 7. Click "Holds" tab and click "Suspend" 8. Note the modal loads properly Signed-off-by: Pedro Amorim --- koha-tmpl/intranet-tmpl/prog/js/holds.js | 33 +++++++++++++++++------- 1 file changed, 23 insertions(+), 10 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/js/holds.js b/koha-tmpl/intranet-tmpl/prog/js/holds.js index 752e0f5b6ab..23e5d61973d 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/holds.js +++ b/koha-tmpl/intranet-tmpl/prog/js/holds.js @@ -373,16 +373,29 @@ $(document).ready(function () { "" ); } else { - return ( - "" + - " " + - __("Suspend") + - "" + const link = document.createElement("a"); + link.classList.add( + "hold-suspend", + "btn", + "btn-default", + "btn-xs" + ); + link.setAttribute( + "data-hold-id", + oObj.reserve_id + ); + link.setAttribute( + "data-hold-title", + oObj.title + ); + link.textContent = " " + __("Suspend"); + const icon = document.createElement("i"); + icon.classList.add("fa", "fa-pause"); + link.insertAdjacentElement( + "afterbegin", + icon ); + return link.outerHTML; } }, }, @@ -491,7 +504,7 @@ $(document).ready(function () { $(".hold-suspend").on("click", function () { var hold_id = $(this).data("hold-id"); var hold_title = $(this).data("hold-title"); - $("#suspend-modal-title").html(hold_title); + $("#suspend-modal-title").text(hold_title); $("#suspend-modal-submit").data("hold-id", hold_id); $("#suspend-modal").modal("show"); }); -- 2.39.5