From f59d3b01b55f95e6c76ce7430a479fa6583dab75 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Sat, 12 Aug 2017 09:09:53 +0530 Subject: [PATCH] Bug 19089 - XSS issue in supplier.pl page 1. Hit /cgi-bin/koha/acqui/supplier.pl?booksellerid=xx. xx - is a booksellerid 2. Notice the java script is executed. 4. Apply patch. 5. Reload page, and hit the page again /cgi-bin/koha/acqui/supplier.pl?booksellerid=xx. xx - is a booksellerid. 6. Notice it is no longer executed. Signed-off-by: Chris Cormack We probably should use a whitelist ie, it should only be digits. Rather than escaping it, but this works. --- acqui/supplier.pl | 2 ++ 1 file changed, 2 insertions(+) diff --git a/acqui/supplier.pl b/acqui/supplier.pl index e0addbc..44fbbf6 100755 --- a/acqui/supplier.pl +++ b/acqui/supplier.pl @@ -42,6 +42,7 @@ To know the bookseller this script has to display details. use strict; use warnings; +use HTML::Entities; use C4::Auth; use C4::Contract; use C4::Biblio; @@ -66,6 +67,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( } ); my $booksellerid = $query->param('booksellerid'); +$booksellerid = HTML::Entities::encode($booksellerid); my $supplier; if ($booksellerid) { $supplier = Koha::Acquisition::Booksellers->find( $booksellerid ); -- 2.1.4