From dc029a7d0a7e613ac2973275aff0e267014d196d Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Mon, 7 Aug 2017 21:24:44 +0530 Subject: [PATCH] Bug 19051 - XSS Flaws in Batch item deletion page Content-Type: text/plain; charset=utf-8 1. Hit /cgi-bin/koha/tools/batchMod.pl?del=1 2. Enter in the Barcode list (one barcode per line) text area. 3. Notice the iframe is executed. 4. Apply patch. 5. Reload page, and enter iframe again on Barcode list (one barcode per line) text area. 6. Notice it is no longer executed. 7. Fixes for both barcode and itemnumber. Signed-off-by: Chris Cormack Signed-off-by: Marcel de Rooy --- koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt index d66d15d..5ad6195 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt @@ -58,7 +58,7 @@ $(document).ready(function(){ [% FOREACH notfoundbarcode IN notfoundbarcodes %] - [% notfoundbarcode.barcode %] + [% notfoundbarcode.barcode |html %] [% END %] -- 2.1.4