From 0f465b505c2d573b8cf478556ebc44eebd706344 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Sun, 20 Aug 2017 20:53:06 +0530 Subject: [PATCH] Bug 16069 - XSS issue in basket.pl page 1. Hit /cgi-bin/koha/acqui/basket.pl?basketno=xx xx - is a basketno 2. Notice the java script is executed. 3. Apply patch. 4. Reload page, and hit the page again /cgi-bin/koha/acqui/basket.pl?basketno==xx xx - is a basketno. 5. Notice it is no longer executed. Fix for 16.11.x --- koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt index 2695796..109c9eb 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt @@ -4,7 +4,7 @@ [% USE AuthorisedValues %] [% INCLUDE 'doc-head-open.inc' %] -Koha › Acquisitions › [% UNLESS ( basketno ) %]New [% END %]Basket [% basketname|html %] ([% basketno %]) for [% name|html %] +Koha › Acquisitions › [% UNLESS ( basketno ) %]New [% END %]Basket [% basketname|html %] ([% basketno |html %]) for [% name|html %] [% INCLUDE 'doc-head-close.inc' %] [% INCLUDE 'datatables.inc' %] @@ -68,7 +68,7 @@ function confirm_ediorder() { var is_confirmed = confirm(_("Are you sure you want to close this basket and generate an EDIFACT order?")); if (is_confirmed) { - window.location = "/cgi-bin/koha/acqui/basket.pl?op=edi_confirm&basketno=[% basketno %]"; + window.location = "/cgi-bin/koha/acqui/basket.pl?op=edi_confirm&basketno=[% basketno |html %]"; } } @@ -93,7 +93,7 @@ var skip = [% IF ( skip_confirm_reopen ) %] 1 [% ELSE %] 0 [% END %]; var is_confirmed = skip || confirm(_("Are you sure you want to reopen this basket?")); if (is_confirmed) { - window.location = "/cgi-bin/koha/acqui/basket.pl?op=reopen&basketno=[% basketno %]"; + window.location = "/cgi-bin/koha/acqui/basket.pl?op=reopen&basketno=[% basketno |html %]"; } } //]]> @@ -167,7 +167,7 @@ [% INCLUDE 'acquisitions-search.inc' %] - +
@@ -317,7 +317,7 @@ [% END %]
[% END %] -

[% UNLESS ( basketno ) %]New [% END %]Basket [% basketname|html %] ([% basketno %]) for [% name|html %]

+

[% UNLESS ( basketno ) %]New [% END %]Basket [% basketname|html %] ([% basketno |html %]) for [% name|html %]

[% IF ( basketno ) %]
-- 2.7.4