From 7f0efc87b7385ac0c6a34b7f9e92e367cb6ed819 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Mon, 7 Aug 2017 22:17:14 +0530 Subject: [PATCH] Bug 19052 - XSS Flaws in - Invoice search page Content-Type: text/plain; charset=utf-8 1. Hit /cgi-bin/koha/acqui/invoices.pl 2. Enter Invoiceno, ISBN/EAN/ISSN, Title, Author, Publihser, Publication year search box. 3. Notice the iframe is executed. 4. Apply patch. 5. Reload page, and enter iframe again on Invoiceno, ISBN/EAN/ISSN, Title, Author, Publihser, Publication year search box. 6. Notice it is no longer executed. Signed-off-by: Chris Cormack Signed-off-by: Marcel de Rooy --- .../prog/en/modules/acqui/invoices.tt | 24 +++++++++++----------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt index c296e9e..de03894 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt @@ -210,7 +210,7 @@ $(document).ready(function() {

Search was:

    [% IF ( invoicenumber ) %] -
  • Invoice no.: [% invoicenumber %]
  • +
  • Invoice no.: [% invoicenumber |html %]
  • [% END %] [% IF booksellerid %]
  • Vendor: [% suppliername %]
  • @@ -248,19 +248,19 @@ $(document).ready(function() { [% END %] [% END %] [% IF ( isbneanissn ) %] -
  • ISBN/EAN/ISSN: [% isbneanissn %]
  • +
  • ISBN/EAN/ISSN: [% isbneanissn |html %]
  • [% END %] [% IF ( title ) %] -
  • Title: [% title %]
  • +
  • Title: [% title |html %]
  • [% END %] [% IF ( author ) %] -
  • Author: [% author %]
  • +
  • Author: [% author |html %]
  • [% END %] [% IF ( publisher ) %] -
  • Publisher: [% publisher %]
  • +
  • Publisher: [% publisher |html %]
  • [% END %] [% IF ( publicationyear ) %] -
  • Publication year: [% publicationyear %]
  • +
  • Publication year: [% publicationyear |html %]
  • [% END %] [% IF ( branch ) %]
  • Library: [% Branches.GetName( branch ) %]
  • @@ -280,7 +280,7 @@ $(document).ready(function() {
    1. - +
    2. @@ -327,23 +327,23 @@ $(document).ready(function() {
    3. - +
    4. - +
    5. - +
    6. - +
    7. - +
    8. -- 2.1.4