From 35144e56efcf115530fb8ab67eea4c37d0acbacf Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Tue, 15 Aug 2017 10:07:45 +0530 Subject: [PATCH] Bug 19103 - Stored XSS in patron-attr-types.pl To Test 1. Hit the page /cgi-bin/koha/admin/patron-attr-types.pl 2. Click on new patron attribute type 2. Add a text in the field Description that contain js. 2. Save the page. 3. Notice js is execute 4. Apply patch and reload, the js is escaped --- .../prog/en/modules/admin/patron-attr-types.tt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt index b0c49bf..55c5f40 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt @@ -272,7 +272,7 @@ $(document).ready(function() { [% FOREACH item IN attribute.items %] [% item.code |html %] - [% item.description %] + [% item.description |html %] [% IF ( item.branches && item.branches.size > 0 ) %] [% branches_str = "" %] -- 1.7.9.5