From bb6d6d89b5157504c85b46324d5ae1d5b7523647 Mon Sep 17 00:00:00 2001 From: Chris Cormack Date: Fri, 11 Aug 2017 19:54:34 +0000 Subject: [PATCH] Bug 19086 Stored XSS in circulation.pl 1/ To test add a message to a borrower that contains js 2/ hit /cgi-bin/koha/circ/circulation.pl?borrowernumber=[number] where number is the borrowernumber of the borrower you set the message for 3/ Notice js is execute 4/ Apply patch, reload, js is escaped --- koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt index ed054ae..0eb96b6 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt @@ -868,7 +868,7 @@ No patron matched [% message | html %] [% IF message.manager_id %] ( [% message.get_column('manager_firstname') %] [% message.get_column('manager_surname') %] ) [% END %] - "[% message.message %]" + "[% message.message | html %]" [% IF message.branchcode == branch OR Koha.Preference('AllowAllMessageDeletion') %] Delete -- 2.1.4