Bugzilla – Attachment 53977 Details for
Bug 17022
branchtransfers.pl is vulnerable to XSS attacks
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[PASSED QA] Bug 17022: Fix XSS in circ/branchtransfers.pl
PASSED-QA-Bug-17022-Fix-XSS-in-circbranchtransfers.patch (text/plain), 2.79 KB, created by
Katrin Fischer
on 2016-08-03 21:39:00 UTC
(
hide
)
Description:
[PASSED QA] Bug 17022: Fix XSS in circ/branchtransfers.pl
Filename:
MIME Type:
Creator:
Katrin Fischer
Created:
2016-08-03 21:39:00 UTC
Size:
2.79 KB
patch
obsolete
>From 9f19710e3802c2899ff2ddaecbb81b0d8d989066 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Tue, 2 Aug 2016 14:00:02 +0100 >Subject: [PATCH] [PASSED QA] Bug 17022: Fix XSS in circ/branchtransfers.pl > >Test plan: >Enter the following in the barcode input: > <script>alert('XSS')</script> > >=> Without this patch you will see the alert >=> With this patch, no more alert > >Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> > >Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> >--- > koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt >index e2916d9..7f0ac14 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt >@@ -40,7 +40,7 @@ > <input type="hidden" name="itemnumber" value="[% itemnumber %]" /> > <input type="hidden" name="borrowernumber" value="[% borrowernumber %]" /> > [% IF ( waiting ) %] >- <input type="hidden" name="barcode" value="[% barcode %]" /> >+ <input type="hidden" name="barcode" value="[% barcode | html %]" /> > <input type="hidden" name="request" value="KillWaiting" /> > <input type="submit" value="Cancel" /> > [% END %] >@@ -64,7 +64,7 @@ > <input type="hidden" name="biblionumber" value="[% biblionumber %]" /> > <input type="hidden" name="borrowernumber" value="[% borrowernumber %]" /> > <input type="hidden" name="tobranchcd" value="[% tobranchcd %]" /> >- <input type="hidden" name="barcode" value="[% barcode %]" /> >+ <input type="hidden" name="barcode" value="[% barcode | html %]" /> > <input type="hidden" name="request" value="KillReserved" /> > <input type="submit" value="Cancel" /> > </form> >@@ -107,7 +107,7 @@ > <ul> > [% FOREACH errmsgloo IN errmsgloop %] > [% IF ( errmsgloo.errbadcode ) %] >- <li>No Item with barcode: [% errmsgloo.msg %]</li> >+ <li>No Item with barcode: [% errmsgloo.msg | html %]</li> > [% END %] > [% IF ( errmsgloo.errispermanent ) %] > <li>Please return item to home library: [% errmsgloo.msg %]</li> >-- >1.9.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 17022
:
53907
|
53968
| 53977