From 5d475e475f1a8b0ebc548590724d63f786be013b Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Fri, 11 Aug 2017 21:23:18 +0530 Subject: [PATCH] Bug 16069 - XSS issue in basket.pl page 1. Hit /cgi-bin/koha/acqui/basket.pl?basketno=xx. xx - is a basketno 2. Notice the java script is executed. 4. Apply patch. 5. Reload page, and hit the page again /cgi-bin/koha/acqui/basket.pl?basketno==xx. xx - is a basketno. 6. Notice it is no longer executed. Signed-off-by: Chris Cormack --- acqui/basket.pl | 2 ++ 1 file changed, 2 insertions(+) diff --git a/acqui/basket.pl b/acqui/basket.pl index 7a039d4..2ac5f54 100755 --- a/acqui/basket.pl +++ b/acqui/basket.pl @@ -21,6 +21,7 @@ # along with Koha; if not, see . use Modern::Perl; +use HTML::Entities; use C4::Auth; use C4::Koha; use C4::Output; @@ -72,6 +73,7 @@ the supplier this script have to display the basket. our $query = new CGI; our $basketno = $query->param('basketno'); +$basketno = HTML::Entities::encode($basketno); our $ean = $query->param('ean'); our $booksellerid = $query->param('booksellerid'); my $duplinbatch = $query->param('duplinbatch'); -- 2.1.4