From 267e301f53cfbe659cde3abbe4ef601156e5d16b Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Tue, 15 Aug 2017 02:44:11 +0530 Subject: [PATCH] Bug 19086 Stored XSS in subscription-add.pl 1. To test - add a text in the field Public note and Nonpublic note that contains js (Internalnotes, notes) 2. Save the page. 3. Notice js is execute 4. Apply patch and reload, the js is escaped --- .../prog/en/modules/serials/subscription-detail.tt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt index 8c95459..a943120 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt @@ -339,8 +339,8 @@ $(document).ready(function() {
  • History end date: [% histenddate %]
  • Received issues:[% recievedlist %]
  • Missing issues:[% missinglist %]
    • -
  • Nonpublic note:[% internalnotes FILTER html_line_break %]
    • -
  • Public note:[% notes FILTER html_line_break %]
    • +
  • Nonpublic note:[% internalnotes FILTER html_line_break |html %]
    • +
  • Public note:[% notes FILTER html_line_break |html %]
  • History staff note:[% librariannote FILTER html_line_break %]
  • History OPAC note:[% opacnote FILTER html_line_break %]
    • -- 1.7.9.5