From 0c0fa3b83ec12877360e4ed1115a9b88dcc6d8df Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 2 Aug 2016 15:41:49 +0100 Subject: [PATCH] Bug 17028: Fix XSS in reserve/request.pl Test plan: Hit /cgi-bin/koha/reserve/request.pl?biblionumber=1"> => Without this patch you will see the alert => With this patch, no more alert --- reserve/request.pl | 1 + 1 file changed, 1 insertion(+) diff --git a/reserve/request.pl b/reserve/request.pl index 8e1f458..1980abb 100755 --- a/reserve/request.pl +++ b/reserve/request.pl @@ -212,6 +212,7 @@ my $borrowerinfo = GetMember( borrowernumber => $borrowernumber_hold ); my $itemdata_enumchron = 0; my @biblioloop = (); foreach my $biblionumber (@biblionumbers) { + next unless $biblionumber =~ m|^\d+$|; my %biblioloopiter = (); -- 2.8.1