From ad1c366b8c0c1d842205b09ebc70972e9768e2db Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Mon, 14 Aug 2017 22:30:46 +0530 Subject: [PATCH] Bug 19086 Stored XSS in notices.pl 1. Hit /cgi-bin/koha/members/notices.pl?borrowernumber=xx xx is a borrowernumber 2. Notice java script is execute. 3. Apply patch. 4. Reload page, and hit the page again /cgi-bin/koha/members/notices.pl?borrowernumber=xx xx is a borrowernumber 5. Notice it is no longer executed. --- members/notices.pl | 2 ++ 1 file changed, 2 insertions(+) diff --git a/members/notices.pl b/members/notices.pl index 977c921..6d7ef86 100755 --- a/members/notices.pl +++ b/members/notices.pl @@ -22,6 +22,7 @@ use strict; #use warnings; FIXME - Bug 2505 use C4::Auth; +use HTML::Entities; use C4::Output; use CGI qw ( -utf8 ); use C4::Members; @@ -33,6 +34,7 @@ my $input=new CGI; my $borrowernumber = $input->param('borrowernumber'); +$borrowernumber = HTML::Entities::encode($borrowernumber); my $patron = Koha::Patrons->find( $borrowernumber ); my $borrower = $patron->unblessed; -- 1.7.9.5