From fff440b4cd0f892d28cadc6cad2fc282d13ba035 Mon Sep 17 00:00:00 2001
From: Amit Gupta <amit.gupta@informaticsglobal.com>
Date: Tue, 15 Aug 2017 02:33:59 +0530
Subject: [PATCH] Bug 19086 Stored XSS in supplier.pl

1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter
2. Add a text in the field company_postal, physical, company_fax,
   accountnumber, contactposition, contact_fax, contact_notes, notes that contains java script
3. Save the page.
4. Notice js is execute
5. Apply patch and reload the js is escaped
---
 .../prog/en/modules/acqui/supplier.tt              |   22 ++++++++++----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt
index 760e9d2..b0e127b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt
@@ -58,15 +58,15 @@
 
 [% BLOCK show_contact %]
     <h3>[% contact.name %]</h3>
-    <p><span class="label">Position: </span>[% contact.position %]</p>
-    <p><span class="label">Phone: </span>[% contact.phone %]</p>
-    <p><span class="label">Alternative phone: </span>[% contact.altphone %]</p>
-    <p><span class="label">Fax: </span>[% contact.fax %]</p>
+    <p><span class="label">Position: </span>[% contact.position |html %]</p>
+    <p><span class="label">Phone: </span>[% contact.phone |html %]</p>
+    <p><span class="label">Alternative phone: </span>[% contact.altphone |html %]</p>
+    <p><span class="label">Fax: </span>[% contact.fax |html %]</p>
     [% IF ( contact.email ) %]
         <p><span class="label">Email: </span><a href="mailto:[% contact.email %]">[% contact.email %]</a></p>
     [% END %]
     [% IF ( contact.notes ) %]
-        <p><span class="label">Notes: </span>[% contact.notes %]</p>
+        <p><span class="label">Notes: </span>[% contact.notes |html %]</p>
     [% END %]
     [% IF ( contact.acqprimary ) %]
         <p><span class="label">Primary acquisitions contact</span></p>
@@ -323,15 +323,15 @@ function delete_contact(ev) {
             <div id="supplier-company-details" class="yui-u first">
                 <h2>Vendor details</h2>
                 <p><span class="label">Company name: </span>[% name %]</p>
-                <p><span class="label">Postal address: </span>[% postal %]</p>
-                <p><span class="label">Physical address: </span>[% address1 %][% address2 %][% address3 %][% address4 %]</p>
-                <p><span class="label">Phone: </span>[% phone %]</p>
-                <p><span class="label">Fax: </span>[% fax %]</p>
+                <p><span class="label">Postal address: </span>[% postal |html %]</p>
+                <p><span class="label">Physical address: </span>[% address1 |html %][% address2 |html %][% address3 |html %][% address4 |html %]</p>
+                <p><span class="label">Phone: </span>[% phone |html %]</p>
+                <p><span class="label">Fax: </span>[% fax |html %]</p>
                 [% IF ( url ) %]
                     <p><span class="label">Website: </span><a href="[% url %]">[% url %]</a></p>
                 [% END %]
                 [% IF ( accountnumber ) %]
-                    <p><span class="label">Account number: </span>[% accountnumber %]</p>
+                    <p><span class="label">Account number: </span>[% accountnumber |html %]</p>
                 [% END %]
 
             <div id="supplier-ordering-information">
@@ -359,7 +359,7 @@ function delete_contact(ev) {
                         [% deliverytime %] days</p>
                 [% END %]
                 [% IF ( notes ) %]<p><strong>Notes: </strong>
-                    [% notes %]</p>[% END %]
+                    [% notes |html %]</p>[% END %]
             </div>
             </div>
 
-- 
1.7.9.5