From 40b41d0b9749d261ac97d4f17da9915abbeef81c Mon Sep 17 00:00:00 2001
From: Amit Gupta <amit.gupta@informaticsglobal.com>
Date: Fri, 11 Aug 2017 21:23:18 +0530
Subject: [PATCH] Bug 16069 - XSS issue in basket.pl page

1. Hit /cgi-bin/koha/acqui/basket.pl?basketno=xx<script>alert('amit')</script>.
   xx - is a basketno
2. Notice the java script is executed.
4. Apply patch.
5. Reload page, and hit the page again /cgi-bin/koha/acqui/basket.pl?basketno==xx<script>alert('amit')</script>.
   xx - is a basketno.
6. Notice it is no longer executed.
---
 acqui/basket.pl |    2 ++
 1 file changed, 2 insertions(+)

diff --git a/acqui/basket.pl b/acqui/basket.pl
index 7a039d4..2ac5f54 100755
--- a/acqui/basket.pl
+++ b/acqui/basket.pl
@@ -21,6 +21,7 @@
 # along with Koha; if not, see <http://www.gnu.org/licenses>.
 
 use Modern::Perl;
+use HTML::Entities;
 use C4::Auth;
 use C4::Koha;
 use C4::Output;
@@ -72,6 +73,7 @@ the supplier this script have to display the basket.
 
 our $query        = new CGI;
 our $basketno     = $query->param('basketno');
+$basketno         = HTML::Entities::encode($basketno);
 our $ean          = $query->param('ean');
 our $booksellerid = $query->param('booksellerid');
 my $duplinbatch =  $query->param('duplinbatch');
-- 
1.7.9.5