From 81d5e12a73e9db20a1e7506bcf9b45387aa0dfa0 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Mon, 14 Aug 2017 21:47:35 +0530 Subject: [PATCH] Bug 19086 Stored XSS in circulation.pl 1. Hit /cgi-bin/koha/circ/circulation.pl?borrowernumber=xx. xx - is a borrowernumber 2. Notice the java script is executed. 4. Apply patch. 5. Reload page, and hit the page again /cgi-bin/koha/circ/circulation.pl?borrowernumber=xx. xx - is a borrowernumber. 6. Notice it is no longer executed. --- circ/circulation.pl | 2 ++ 1 file changed, 2 insertions(+) diff --git a/circ/circulation.pl b/circ/circulation.pl index fad8623..38c50ac 100755 --- a/circ/circulation.pl +++ b/circ/circulation.pl @@ -29,6 +29,7 @@ use warnings; use CGI qw ( -utf8 ); use DateTime; use DateTime::Duration; +use HTML::Entities; use C4::Output; use C4::Print; use C4::Auth qw/:DEFAULT get_session haspermission/; @@ -106,6 +107,7 @@ $barcodes = [ uniq @$barcodes ]; my $template_name = q|circ/circulation.tt|; my $borrowernumber = $query->param('borrowernumber'); +$borrowernumber = HTML::Entities::encode($borrowernumber); my $patron = $borrowernumber ? Koha::Patrons->find( $borrowernumber ) : undef; my $batch = $query->param('batch'); my $batch_allowed = 0; -- 1.7.9.5