From bda623a9c724a5fb9a98ebb0c066c7c61ac68388 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Mon, 14 Aug 2017 22:16:21 +0530 Subject: [PATCH] Bug 19086 Stored XSS in routing-lists.pl 1. Hit /cgi-bin/koha/members/routing-lists.pl?borrowernumber=xx xx is a borrowernumber 2. Notice java script is execute. 3. Apply patch. 3. Reload page, and hit the page again /cgi-bin/koha/members/routing-lists.pl?borrowernumber=xx xx is a borrowernumber 4. Notice it is no longer executed. --- members/routing-lists.pl | 2 ++ 1 file changed, 2 insertions(+) diff --git a/members/routing-lists.pl b/members/routing-lists.pl index 6b024bd..9e65104 100755 --- a/members/routing-lists.pl +++ b/members/routing-lists.pl @@ -20,6 +20,7 @@ use strict; #use warnings; FIXME - Bug 2505 use CGI qw ( -utf8 ); +use HTML::Entities; use C4::Output; use C4::Auth qw/:DEFAULT/; use C4::Members; @@ -45,6 +46,7 @@ my $findborrower = $query->param('findborrower'); $findborrower =~ s|,| |g; my $borrowernumber = $query->param('borrowernumber'); +$borrowernumber = HTML::Entities::encode($borrowernumber); my $branch = C4::Context->userenv->{'branch'}; -- 1.7.9.5