From 769225a2eba334adb7410fc8884be582e933577c Mon Sep 17 00:00:00 2001 From: Amit Gupta <amit.gupta@informaticsglobal.com> Date: Tue, 15 Aug 2017 13:33:57 +0530 Subject: [PATCH 1/2] Bug 19108 - Stored XSS in oai_sets.pl To Test 1. Hit the page /cgi-bin/koha/admin/oai_sets.pl 2. Click on New set 3. Add a text in the field setSpec, setName that contains js 4. Save the page. 5. Notice js is execute 6. Apply patch and reload, the js is escaped --- .../prog/en/modules/admin/oai_set_mappings.tt | 2 +- .../prog/en/modules/admin/oai_sets.tt | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt index f3f35b7..338a53f 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt @@ -56,7 +56,7 @@ function hideDialogBox() { <p><a href="/cgi-bin/koha/admin/oai_sets.pl">Return to sets management</a></p> </div> [% END %] - <h1>Mappings for set '[% setName %]' ([% setSpec %])</h1> + <h1>Mappings for set '[% setName |html %]' ([% setSpec |html %])</h1> [% UNLESS ( mappings ) %] <div class="dialog alert"><p><strong>Warning:</strong> No mappings have been defined for this set</p></div> [% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt index 0576739..3475442 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt @@ -45,7 +45,7 @@ $(document).ready(function() { [% INCLUDE 'header.inc' %] [% INCLUDE 'prefs-admin-search.inc' %] -<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> › <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> › [% IF ( op_new ) %]<a href="/cgi-bin/koha/admin/oai_sets.pl">OAI sets configuration</a> › Add a new OAI set[% ELSIF ( op_mod ) %]<a href="/cgi-bin/koha/admin/oai_sets.pl">OAI sets configuration</a> › Edit OAI set '[% spec %]'[% ELSE %] OAI sets configuration[% END %]</div> +<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> › <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> › [% IF ( op_new ) %]<a href="/cgi-bin/koha/admin/oai_sets.pl">OAI sets configuration</a> › Add a new OAI set[% ELSIF ( op_mod ) %]<a href="/cgi-bin/koha/admin/oai_sets.pl">OAI sets configuration</a> › Edit OAI set '[% spec |html %]'[% ELSE %] OAI sets configuration[% END %]</div> <div id="doc3" class="yui-t2"> @@ -58,7 +58,7 @@ $(document).ready(function() { <h2>Add a new OAI set</h2> <input type="hidden" name="op" value="savenew" /> [% ELSIF ( op_mod ) %] - <h2>Edit OAI set '[% spec %]'</h2> + <h2>Edit OAI set '[% spec |html %]'</h2> <input type="hidden" name="op" value="savemod" /> <input type="hidden" name="id" value="[% id %]" /> [% END %] @@ -109,13 +109,13 @@ $(document).ready(function() { <tbody> [% FOREACH set IN sets_loop %] <tr> - <td>[% set.spec %]</td> - <td>[% set.name %]</td> + <td>[% set.spec |html %]</td> + <td>[% set.name |html %]</td> <td> [% IF set.descriptions %] <ul> [% FOREACH desc IN set.descriptions %] - <li>[% desc.description %]</li> + <li>[% desc.description |html %]</li> [% END %] </ul> [% ELSE %] -- 1.7.9.5