From 49c976f356baec763fc479cd080c4df2ce4d78e4 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Tue, 15 Aug 2017 22:42:19 +0530 Subject: [PATCH] Bug 19089 - XSS issue in supplier.pl page 1. Hit /cgi-bin/koha/acqui/supplier.pl?booksellerid=xx xx - is a booksellerid 2. Notice the java script is executed. 3. Apply patch. 4. Reload page, and hit the page again /cgi-bin/koha/acqui/supplier.pl?booksellerid=xx xx - is a booksellerid. 5. Notice it is no longer executed. --- .../prog/en/includes/acquisitions-toolbar.inc | 2 +- .../prog/en/modules/acqui/supplier.tt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc index a82ab41..05ef76a 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc @@ -2,7 +2,7 @@ // diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt index 760e9d2..db849a8 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt @@ -95,7 +95,7 @@ //