From d4c55e92128c384e5c015b5b989c63773b6ea47a Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Fri, 4 Aug 2017 10:38:12 +0530 Subject: [PATCH 1/2] Bug 19034 - XSS Flaws in Cities 1. Hit /cgi-bin/koha/admin/cities.pl 2. Enter search cities box. 3. Notice the iframe is executed. 4. Apply patch. 5. Reload page, and enter iframe again on search cities box. 6. Notice it is no longer executed. --- .../intranet-tmpl/prog/en/modules/admin/cities.tt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt index 7acb4d6..a440cf1 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt @@ -143,7 +143,7 @@

Cities

[% IF searchfield %] - Searching: [% searchfield %] + Searching: [% searchfield |html %] [% END %] [% IF cities.count %] -- 1.7.9.5