From d98e4c1db07a1935dfa0dd5fad1c704eb5037639 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Tue, 15 Aug 2017 10:15:54 +0530 Subject: [PATCH] [SIGNED OFF] Bug 19103 - Stored XSS in matching-rules.pl To Test 1. Hit the page /cgi-bin/koha/admin/matching-rules.pl 2. Click on new record matching rule 3. Add a text in the field Description that contain js. 4. Save the page. 5. Notice js is execute 6. Apply patch and reload, the js is escaped Signed-off-by: Katrin Fischer --- koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt index e75398c..6c15b2b 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt @@ -602,7 +602,7 @@ function CheckRuleForm(f) { [% available_matching_rule.matcher_id %] [% available_matching_rule.code %] - [% available_matching_rule.description %] + [% available_matching_rule.description |html %] Edit Delete -- 2.7.4