Bugzilla – Attachment 67091 Details for
Bug 19127
Stored XSS in csv-profiles.pl
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 19127: (follow-up) Stored XSS in csv-profiles.pl
Bug-19127-follow-up-Stored-XSS-in-csv-profilespl.patch (text/plain), 2.26 KB, created by
Jonathan Druart
on 2017-09-12 14:21:48 UTC
(
hide
)
Description:
Bug 19127: (follow-up) Stored XSS in csv-profiles.pl
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2017-09-12 14:21:48 UTC
Size:
2.26 KB
patch
obsolete
>From 8a57b636f1648eba9a4d53fdf0203caec257012a Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Tue, 12 Sep 2017 11:21:27 -0300 >Subject: [PATCH] Bug 19127: (follow-up) Stored XSS in csv-profiles.pl > >--- > koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt >index 181eb35d6c..cdbaab9fe5 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt >@@ -133,7 +133,7 @@ function reloadPage(p) { > [% END %] > <li> > <label for="profile" class="required">Profile name: </label> >- <input type="text" name="profile" id="profile" value="[% csv_profile.profile %]" class="required"> >+ <input type="text" name="profile" id="profile" value="[% csv_profile.profile | html %]" class="required"> > <span class="required">Required</span> > </li> > <li> >@@ -175,7 +175,7 @@ function reloadPage(p) { > </li> > <li> > <label for="description">Profile description: </label> >- <textarea cols="50" rows="2" name="description" id="description">[% csv_profile.description %]</textarea> >+ <textarea cols="50" rows="2" name="description" id="description">[% csv_profile.description | html %]</textarea> > </li> > <li> > <label for="csv_separator">CSV separator: </label> >@@ -240,7 +240,7 @@ function reloadPage(p) { > [% IF op == 'delete_confirm' %] > <div class="dialog alert"> > [% IF csv_profile %] >- <h3>Delete CSV Profile "[% csv_profile.profile %]?"</h3> >+ <h3>Delete CSV Profile "[% csv_profile.profile | html %]?"</h3> > <form action="/cgi-bin/koha/tools/csv-profiles.pl" method="post"> > <input type="hidden" name="op" value="delete_confirmed" /> > <input type="hidden" name="export_format_id" value="[% csv_profile.export_format_id %]" /> >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 19127
:
66089
|
66219
|
66450
| 67091