From d98e4c1db07a1935dfa0dd5fad1c704eb5037639 Mon Sep 17 00:00:00 2001 From: Amit Gupta <amit.gupta@informaticsglobal.com> Date: Tue, 15 Aug 2017 10:15:54 +0530 Subject: [PATCH] [SIGNED OFF] Bug 19103 - Stored XSS in matching-rules.pl To Test 1. Hit the page /cgi-bin/koha/admin/matching-rules.pl 2. Click on new record matching rule 3. Add a text in the field Description that contain js. 4. Save the page. 5. Notice js is execute 6. Apply patch and reload, the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> --- koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt index e75398c..6c15b2b 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt @@ -602,7 +602,7 @@ function CheckRuleForm(f) { <tr> <td>[% available_matching_rule.matcher_id %]</td> <td>[% available_matching_rule.code %]</td> - <td>[% available_matching_rule.description %]</td> + <td>[% available_matching_rule.description |html %]</td> <td class="actions"> <a class="btn btn-default btn-xs" href="[% available_matching_rule.script_name %]?op=edit_matching_rule&matcher_id=[% available_matching_rule.matcher_id |html %]"><i class="fa fa-pencil"></i> Edit</a> <a class="btn btn-default btn-xs" href="[% available_matching_rule.script_name %]?op=delete_matching_rule&matcher_id=[% available_matching_rule.matcher_id |html %]"><i class="fa fa-trash"></i> Delete</a> -- 2.7.4