From 8752be955eb956a7d38d2209e5bf77b8e8ffc363 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Tue, 15 Aug 2017 02:44:11 +0530 Subject: [PATCH] Bug 19086 Stored XSS in subscription-add.pl To Test 1. Hit the page /cgi-bin/koha/serials/subscription-add.pl 2. Add a text in the field Public note and Nonpublic note that contains js (Internalnotes, notes) 2. Save the page. 3. Notice js is execute 4. Apply patch and reload, the js is escaped --- .../prog/en/modules/serials/subscription-detail.tt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt index 8c95459..a943120 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt @@ -339,8 +339,8 @@ $(document).ready(function() {
  • History end date: [% histenddate %]
  • Received issues:[% recievedlist %]
  • Missing issues:[% missinglist %]
  • -
  • Nonpublic note:[% internalnotes FILTER html_line_break %]
  • -
  • Public note:[% notes FILTER html_line_break %]
  • +
  • Nonpublic note:[% internalnotes FILTER html_line_break |html %]
  • +
  • Public note:[% notes FILTER html_line_break |html %]
  • History staff note:[% librariannote FILTER html_line_break %]
  • History OPAC note:[% opacnote FILTER html_line_break %]
  • -- 1.7.9.5