From e84be049dbe04f5776dd8671013834a2a6913115 Mon Sep 17 00:00:00 2001
From: Amit Gupta <amit.gupta@informaticsglobal.com>
Date: Mon, 14 Aug 2017 22:27:03 +0530
Subject: [PATCH] Bug 19086 Stored XSS in readingrec.pl

1. Hit /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
---
 members/readingrec.pl |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/members/readingrec.pl b/members/readingrec.pl
index b0b563c..5a26851 100755
--- a/members/readingrec.pl
+++ b/members/readingrec.pl
@@ -24,7 +24,7 @@ use strict;
 use warnings;
 
 use CGI qw ( -utf8 );
-
+use HTML::Entities;
 use C4::Auth;
 use C4::Output;
 use C4::Members;
@@ -59,7 +59,7 @@ if ($input->param('cardnumber')) {
     $borrowernumber = $data->{'borrowernumber'}; # we must define this as it is used to retrieve other data about the patron
 }
 if ($input->param('borrowernumber')) {
-    $borrowernumber = $input->param('borrowernumber');
+    $borrowernumber = HTML::Entities::encode($input->param('borrowernumber'));
     $patron = Koha::Patrons->find( $borrowernumber );
     $data = $patron->unblessed;
 }
-- 
1.7.9.5