From 2067586a897cee0a48333b0e596d3d36cfb3af08 Mon Sep 17 00:00:00 2001 From: David Cook Date: Tue, 29 Jul 2025 04:07:37 +0000 Subject: [PATCH] Bug 40538: Fix XSS in suspend hold modal Content-Type: text/plain; charset=utf-8 This patch fixes a XSS vulnerability in the suspend hold modal in the staff interface. By building our Javascript using Web APIs rather than with strings and jQuery's html() method, we're able to securely handle malicious payloads. Test plan: 0. Apply the patch 1. Go to http://localhost:8081/cgi-bin/koha/reserve/request.pl?biblionumber=29 2. Add a hold for "koha" patron 3. Go to http://localhost:8081/cgi-bin/koha/circ/circulation.pl?borrowernumber=51 4. Click "Holds" tab and click "Suspend" 5. Note the modal loads properly 6. Go to http://localhost:8081/cgi-bin/koha/members/moremember.pl?borrowernumber=51 7. Click "Holds" tab and click "Suspend" 8. Note the modal loads properly Signed-off-by: Pedro Amorim Signed-off-by: Marcel de Rooy --- koha-tmpl/intranet-tmpl/prog/js/holds.js | 33 +++++++++++++++++------- 1 file changed, 23 insertions(+), 10 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/js/holds.js b/koha-tmpl/intranet-tmpl/prog/js/holds.js index 752e0f5b6a..23e5d61973 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/holds.js +++ b/koha-tmpl/intranet-tmpl/prog/js/holds.js @@ -373,16 +373,29 @@ $(document).ready(function () { "" ); } else { - return ( - "" + - " " + - __("Suspend") + - "" + const link = document.createElement("a"); + link.classList.add( + "hold-suspend", + "btn", + "btn-default", + "btn-xs" + ); + link.setAttribute( + "data-hold-id", + oObj.reserve_id + ); + link.setAttribute( + "data-hold-title", + oObj.title + ); + link.textContent = " " + __("Suspend"); + const icon = document.createElement("i"); + icon.classList.add("fa", "fa-pause"); + link.insertAdjacentElement( + "afterbegin", + icon ); + return link.outerHTML; } }, }, @@ -491,7 +504,7 @@ $(document).ready(function () { $(".hold-suspend").on("click", function () { var hold_id = $(this).data("hold-id"); var hold_title = $(this).data("hold-title"); - $("#suspend-modal-title").html(hold_title); + $("#suspend-modal-title").text(hold_title); $("#suspend-modal-submit").data("hold-id", hold_id); $("#suspend-modal").modal("show"); }); -- 2.39.5