From 9db022a5748bef92ee6da184de87ce43427e8e0a Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Mon, 7 Aug 2017 20:49:56 +0530 Subject: [PATCH] Bug 19050 - XSS Flaws in Quick spine label creator 1. Hit /cgi-bin/koha/labels/spinelabel-home.pl 2. Enter barcode text box. 3. Notice the iframe is executed 4. Apply patch 5. Reload page, and enter iframe again on barcode text box. 6. Notice it is no longer executed --- .../prog/en/modules/labels/spinelabel-print.tt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt index 85aaae4..7881d33 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt @@ -23,7 +23,7 @@ [% IF ( BarcodeNotFound ) %] -

The barcode [% Barcode %] was not found.

The barcode [% Barcode |html %] was not found.

[% ELSE %] -- 1.7.9.5