Bugzilla – Attachment 53984 Details for
Bug 17036
circulation.pl is vulnerable to XSS attacks
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 17036: Fix XSS in circulation.pl
Bug-17036-Fix-XSS-in-circulationpl.patch (text/plain), 1.10 KB, created by
Chris Cormack
on 2016-08-03 22:25:42 UTC
(
hide
)
Description:
Bug 17036: Fix XSS in circulation.pl
Filename:
MIME Type:
Creator:
Chris Cormack
Created:
2016-08-03 22:25:42 UTC
Size:
1.10 KB
patch
obsolete
>From c29c7eceaa080d1095ac4ebfce21d86d0cb87d21 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Wed, 3 Aug 2016 08:49:10 +0100 >Subject: [PATCH] Bug 17036: Fix XSS in circulation.pl > >Test plan: >Enter the following in the "Check out" tab: >"><script>alert('XSS')</script> > >=> Without this patch you will see the alert >=> With this patch, no more alert > >Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> >--- > koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt >index b02851f..7435f8a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt >@@ -538,7 +538,7 @@ $(document).ready(function() { > [% IF ( message ) %] > [% INCLUDE 'patron-toolbar.inc' %] > <h4> >-No patron matched <span class="ex">[% message %]</span> >+No patron matched <span class="ex">[% message | html %]</span> > </h4> > [% END %] > >-- >2.8.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 17036
:
53934
|
53984
|
54112