From f552c6fb460e05e68ac7cf83b909dc50824ad795 Mon Sep 17 00:00:00 2001
From: Amit Gupta <amit.gupta@informaticsglobal.com>
Date: Tue, 15 Aug 2017 08:33:41 +0530
Subject: [PATCH] [SIGNED OFF] Bug 19035 - Stored XSS in lists.pl
To Test
1. Hit the page /cgi-bin/koha/patron_lists/lists.pl
2. Click on new patron list
3. Add a text in the field Name that contains js
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped
Fixed in both the pages list.pl and list.pl?patron_list_id=xx
xx is patronlist id
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
---
koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt | 4 ++--
koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/lists.tt | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt
index 956cc28..c06997a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt
@@ -69,13 +69,13 @@ $(document).ready(function() {
<body id="patlist_list" class="pat patlist">
[% INCLUDE 'header.inc' %]
[% INCLUDE 'cat-search.inc' %]
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> › <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> › <a href="lists.pl">Patron lists</a> › <a href="/cgi-bin/koha/patron_lists/list.pl?patron_list_id=[% list.id %]">[% list.name %]</a> › Add patrons</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> › <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> › <a href="lists.pl">Patron lists</a> › <a href="/cgi-bin/koha/patron_lists/list.pl?patron_list_id=[% list.id %]">[% list.name |html %]</a> › Add patrons</div>
<div id="doc3" class="yui-t2">
<div id="bd">
<div id="yui-main">
<div class="yui-b">
- <h1>[% list.name %]</h1>
+ <h1>[% list.name |html %]</h1>
<form action="list.pl" id="add_patrons" method="post">
<fieldset>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/lists.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/lists.tt
index fb60e2e..df890d6 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/lists.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/lists.tt
@@ -87,7 +87,7 @@
<tbody>
[% FOREACH l IN lists %]
<tr>
- <td>[% l.name %]</td>
+ <td>[% l.name |html %]</td>
<td>[% l.patron_list_patrons_rs.count || 0 %]</td>
<td>
<div class="dropdown">
--
2.7.4