From 86c35879db3343b4aaaf5f5bc73657f46dafe869 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Mon, 7 Aug 2017 20:49:56 +0530 Subject: [PATCH] Bug 19050 - XSS Flaws in Quick spine label creator Content-Type: text/plain; charset=utf-8 1. Hit /cgi-bin/koha/labels/spinelabel-home.pl 2. Enter barcode text box. 3. Notice the iframe is executed 4. Apply patch 5. Reload page, and enter iframe again on barcode text box. 6. Notice it is no longer executed Signed-off-by: Chris Cormack Signed-off-by: Marcel de Rooy --- koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt index 85aaae4..47b3602 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt @@ -23,7 +23,7 @@ [% IF ( BarcodeNotFound ) %] -

The barcode [% Barcode %] was not found.

The barcode [% Barcode |html %] was not found.

[% ELSE %] -- 2.1.4