From 769225a2eba334adb7410fc8884be582e933577c Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Tue, 15 Aug 2017 13:33:57 +0530 Subject: [PATCH 1/2] Bug 19108 - Stored XSS in oai_sets.pl To Test 1. Hit the page /cgi-bin/koha/admin/oai_sets.pl 2. Click on New set 3. Add a text in the field setSpec, setName that contains js 4. Save the page. 5. Notice js is execute 6. Apply patch and reload, the js is escaped --- .../prog/en/modules/admin/oai_set_mappings.tt | 2 +- .../prog/en/modules/admin/oai_sets.tt | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt index f3f35b7..338a53f 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt @@ -56,7 +56,7 @@ function hideDialogBox() {

Return to sets management

[% END %] -

Mappings for set '[% setName %]' ([% setSpec %])

+

Mappings for set '[% setName |html %]' ([% setSpec |html %])

[% UNLESS ( mappings ) %]

Warning: No mappings have been defined for this set

[% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt index 0576739..3475442 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt @@ -45,7 +45,7 @@ $(document).ready(function() { [% INCLUDE 'header.inc' %] [% INCLUDE 'prefs-admin-search.inc' %] - +
@@ -58,7 +58,7 @@ $(document).ready(function() {

Add a new OAI set

[% ELSIF ( op_mod ) %] -

Edit OAI set '[% spec %]'

+

Edit OAI set '[% spec |html %]'

[% END %] @@ -109,13 +109,13 @@ $(document).ready(function() { [% FOREACH set IN sets_loop %] - [% set.spec %] - [% set.name %] + [% set.spec |html %] + [% set.name |html %] [% IF set.descriptions %] [% ELSE %] -- 1.7.9.5