From b2ccf59691c0306b8474f33e6aee5e6bd45d0b9c Mon Sep 17 00:00:00 2001 From: Chris Cormack <chrisc@catalyst.net.nz> Date: Thu, 26 May 2016 21:33:33 +1200 Subject: [PATCH] Bug 16597: Fix XSS in opac-shareshelf To test 1/ Go to /cgi-bin/koha/opac-shareshelf.pl?op="><script>alert('XSS')</script>&shelfnumber=5 2/ Notice you see a js alert 3/ Apply patch 4/ It is gone Reported by Alex Middleton at Dionach Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> --- koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shareshelf.tt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shareshelf.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shareshelf.tt index 8a9de13..66710d9 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shareshelf.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shareshelf.tt @@ -32,7 +32,7 @@ <div id="shareshelf" class="maincontent"> [% IF errcode %] - [% IF errcode==1 && op %]<div class="alert">The operation [% op %] is not supported.</div>[% END %] + [% IF errcode==1 && op %]<div class="alert">The operation [% op | html %] is not supported.</div>[% END %] [% IF errcode==1 && !op %]<div class="alert">No operation parameter has been passed.</div>[% END %] [% IF errcode==2 %]<div class="alert">Invalid shelf number.</div>[% END %] [% IF errcode==3 %]<div class="alert">The feature of sharing lists is not in use in this library.</div>[% END %] -- 2.7.4