From 1ae54b6c9b439630212c2eb5ef110043f56b87d2 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Tue, 15 Aug 2017 13:49:10 +0530 Subject: [PATCH] [SIGNED OFF] Bug 19108 - Stored XSS in items_search_fields.pl To Test 1. Hit the page /cgi-bin/koha/admin/items_search_fields.pl 2. Add a text in the field Name and Label that contains js 3. Save the page. 4. Notice js is execute 5. Apply patch and reload, the js is escaped Fixed for new and edit page Signed-off-by: Katrin Fischer --- .../prog/en/includes/admin-items-search-field-form.inc | 4 ++-- koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt | 4 ++-- .../intranet-tmpl/prog/en/modules/admin/items_search_fields.tt | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/admin-items-search-field-form.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/admin-items-search-field-form.inc index a55f6c3..4ab91b1 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/admin-items-search-field-form.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/admin-items-search-field-form.inc @@ -3,7 +3,7 @@
  • [% IF field %] Name: - [% field.name %] + [% field.name |html %] [% ELSE %] @@ -14,7 +14,7 @@
  • [% IF field %] - + [% ELSE %] [% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt index cd29b2f..06fcd06 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt @@ -10,14 +10,14 @@ HomeAdministrationItem search fields › - [% field.name %] + [% field.name |html %]
    -

    Item search field: [% field.label %]

    +

    Item search field: [% field.label |html %]

    diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_fields.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_fields.tt index eb67749..0904553 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_fields.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_fields.tt @@ -27,7 +27,7 @@ [% IF field_added %]
    - Field successfully added: [% field_added.label %] + Field successfully added: [% field_added.label |html %]
    [% ELSIF field_not_added %]
    @@ -71,8 +71,8 @@ [% FOREACH field IN fields %] - [% field.name %] - [% field.label %] + [% field.name |html %] + [% field.label |html %] [% field.tagfield %] [% field.tagsubfield %] [% field.authorised_values_category %] -- 2.7.4