From 871457441de0876e1d12b9704273306b73d020af Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Mon, 7 Aug 2017 22:17:14 +0530 Subject: [PATCH] Bug 19052 - XSS Flaws in - Invoice search page 1. Hit /cgi-bin/koha/acqui/invoices.pl 2. Enter Invoiceno, ISBN/EAN/ISSN, Title, Author, Publihser, Publication year search box. 3. Notice the iframe is executed. 4. Apply patch. 5. Reload page, and enter iframe again on Invoiceno, ISBN/EAN/ISSN, Title, Author, Publihser, Publication year search box. 6. Notice it is no longer executed. --- .../prog/en/modules/acqui/invoices.tt | 24 ++++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt index c296e9e..de03894 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt @@ -210,7 +210,7 @@ $(document).ready(function() {

Search was: