From b6c6eff5fb426d7b7f3e438253bb51d605776fcd Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Tue, 15 Aug 2017 23:22:32 +0530 Subject: [PATCH] Bug 19100 - XSS Flaws in memberentry.pl 1. Hit /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx xx - is a guarantorid 2. Notice the java script is executed. 3. Apply patch. 4. Reload page, and hit the page again /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx xx - is a guarantorid. 5. Notice it is no longer executed. --- .../prog/en/modules/members/memberentrygen.tt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt index 7f6f734..af75832 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt @@ -413,7 +413,7 @@ $(document).ready(function() { [% ELSE %] [% UNLESS nocontactname %]
  • -- 1.7.9.5