From 7df5b5be82fe07cfb337e1e5f93dc4cab4ce1804 Mon Sep 17 00:00:00 2001 From: Chris Cormack Date: Fri, 19 Jun 2015 11:26:02 +1200 Subject: [PATCH] [PASSED QA] Bug 14416 Stored XSS vulnerability opac-addbybiblionumber.pl is also vulnerable because it doesn't escape list names. To test 1/ Create a malicious list name 2/ Try to add a biblio to the lists 3/ Notice js is excuted 4/ Apply patch 5/ Test again Signed-off-by: Jonathan Druart Signed-off-by: Katrin Fischer --- koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt index cb9bcb6..81edb61 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt @@ -30,12 +30,12 @@ -- 1.7.10.4