From 6f74d9632cb4d97b3172d5125f56fac1a07061ca Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Tue, 15 Aug 2017 10:07:45 +0530 Subject: [PATCH] Bug 19103 - Stored XSS in patron-attr-types.pl Content-Type: text/plain; charset=utf-8 To Test 1. Hit the page /cgi-bin/koha/admin/patron-attr-types.pl 2. Click on new patron attribute type 2. Add a text in the field Description that contain js. 2. Save the page. 3. Notice js is execute 4. Apply patch and reload, the js is escaped Signed-off-by: Katrin Fischer Signed-off-by: Marcel de Rooy --- koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt index b0c49bf..55c5f40 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt @@ -272,7 +272,7 @@ $(document).ready(function() { [% FOREACH item IN attribute.items %] [% item.code |html %] - [% item.description %] + [% item.description |html %] [% IF ( item.branches && item.branches.size > 0 ) %] [% branches_str = "" %] -- 2.1.4