From 9066c75a8f466852383e27b2cfe7be5446650129 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Mon, 14 Aug 2017 22:44:28 +0530 Subject: [PATCH] Bug 19086 Stored XSS in mancredit.pl 1. Hit /cgi-bin/koha/members/mancredit.pl?borrowernumber=xx xx is a borrowernumber 2. Notice java script is execute. 3. Apply patch. 4. Reload page, and hit the page again /cgi-bin/koha/members/mancredit.pl?borrowernumber=xx xx is a borrowernumber 5. Notice it is no longer executed. --- members/mancredit.pl | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/members/mancredit.pl b/members/mancredit.pl index 4855c24..d0e13fe 100755 --- a/members/mancredit.pl +++ b/members/mancredit.pl @@ -24,7 +24,7 @@ use strict; use warnings; - +use HTML::Entities; use C4::Auth; use C4::Output; use CGI qw ( -utf8 ); @@ -41,6 +41,7 @@ my $input=new CGI; my $flagsrequired = { borrowers => 1, updatecharges => 1 }; my $borrowernumber=$input->param('borrowernumber'); +$borrowernumber = HTML::Entities::encode($borrowernumber); my $patron = Koha::Patrons->find( $borrowernumber ); my $add=$input->param('add'); -- 1.7.9.5