Bugzilla – Attachment 66031 Details for
Bug 19079
XSS Flaws in Membership page
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 19079 - XSS Flaws in Membership page
Bug-19079---XSS-Flaws-in-Membership-page.patch (text/plain), 1.37 KB, created by
Jonathan Druart
on 2017-08-15 17:27:27 UTC
(
hide
)
Description:
Bug 19079 - XSS Flaws in Membership page
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2017-08-15 17:27:27 UTC
Size:
1.37 KB
patch
obsolete
>From 5d86d88e68d230b9f8db7786fd91eb030a77f2b0 Mon Sep 17 00:00:00 2001 >From: Amit Gupta <amit.gupta@informaticsglobal.com> >Date: Fri, 11 Aug 2017 21:08:14 +0530 >Subject: [PATCH] Bug 19079 - XSS Flaws in Membership page > >1. Hit /cgi-bin/koha/members/moremember.pl?borrowernumber=xx<script>alert('amit')</script>. > xx - is a borrowernumber >2. Notice the java script is executed. >4. Apply patch. >5. Reload page, and hit the page again /cgi-bin/koha/members/moremember.pl?borrowernumber=xx<script>alert('amit')</script>. > xx - is a borrowernumber. >6. Notice it is no longer executed. > >Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> > >Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >--- > members/moremember.pl | 2 ++ > 1 file changed, 2 insertions(+) > >diff --git a/members/moremember.pl b/members/moremember.pl >index b70a068150..5b61df3e25 100755 >--- a/members/moremember.pl >+++ b/members/moremember.pl >@@ -36,6 +36,7 @@ > use strict; > #use warnings; FIXME - Bug 2505 > use CGI qw ( -utf8 ); >+use HTML::Entities; > use C4::Context; > use C4::Auth; > use C4::Output; >@@ -116,6 +117,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( > } > ); > my $borrowernumber = $input->param('borrowernumber'); >+$borrowernumber = HTML::Entities::encode($borrowernumber); > my $error = $input->param('error'); > $template->param( error => $error ) if ( $error ); > >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 19079
:
65833
|
65917
|
65930
| 66031