From 23a53bea9061ef42097a217a89cccfb357d4c760 Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Tue, 24 Feb 2026 12:58:41 +0000 Subject: [PATCH] Bug 14962: (QA follow-up) Fix stored XSS in display_name rendering in item table display_name was concatenated directly into an HTML string via .format() with no escaping. A display name containing HTML/JS would execute as stored XSS for all staff viewing item details. Use jQuery DOM construction instead so display_name is treated as text, not markup. Sponsored-by: ByWater Solutions Signed-of-by: Martin Renvoize --- .../html_helpers/tables/items/catalogue_detail.inc | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/html_helpers/tables/items/catalogue_detail.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/html_helpers/tables/items/catalogue_detail.inc index 53dd6d781cc..d26b329aee0 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/html_helpers/tables/items/catalogue_detail.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/html_helpers/tables/items/catalogue_detail.inc @@ -729,8 +729,12 @@ [% IF Koha.Preference('UseDisplayModule') && CAN_user_displays %] displays.forEach(display => { display.display_items.forEach(display_item => { - if (display_item.itemnumber === row.item_id) - nodes += '
  • %s
  • '.format(display.display_id, display.display_name); + if (display_item.itemnumber === row.item_id) { + const link = $("") + .attr("href", "/cgi-bin/koha/display/displays/" + display.display_id) + .text(display.display_name); + nodes += $("
  • ").append($('').append(link)).prop("outerHTML"); + } }); }); -- 2.53.0