Bugzilla – Attachment 69099 Details for
Bug 19611
XSS Flaws in supplier.pl
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 19611 - XSS Flaws in supplier.pl
0001-Bug-19611-XSS-Flaws-in-supplier.pl.patch (text/plain), 2.80 KB, created by
Amit Gupta
on 2017-11-12 15:47:16 UTC
(
hide
)
Description:
Bug 19611 - XSS Flaws in supplier.pl
Filename:
MIME Type:
Creator:
Amit Gupta
Created:
2017-11-12 15:47:16 UTC
Size:
2.80 KB
patch
obsolete
>From 1ec87bb02fa335e0db761d96e13c6aba868a66e1 Mon Sep 17 00:00:00 2001 >From: Amit Gupta <amit.gupta@informaticsglobal.com> >Date: Sun, 12 Nov 2017 21:14:41 +0530 >Subject: [PATCH] Bug 19611 - XSS Flaws in supplier.pl > >Test >1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter >2. Add a text in the field Name that contains java script >3. Save the page. >4. Notice js is execute >5. Apply patch and reload the js is escaped >--- > koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt | 2 +- > koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt >index e8acf39..43b43a2 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt >@@ -100,7 +100,7 @@ $(document).ready(function() { > [% END %] > <span class="suppliername"> > [% IF (supplier.name) %] >- <a name="[% supplier.booksellerid %]" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% supplier.booksellerid %]">[% supplier.name %]</a> >+ <a name="[% supplier.booksellerid %]" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% supplier.booksellerid %]">[% supplier.name |html %]</a> > [% ELSE %] > <a name="[% supplier.booksellerid %]" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% supplier.booksellerid %]">NO NAME</a> > [% END %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt >index 085875f..07954a3 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt >@@ -169,7 +169,7 @@ function delete_contact(ev) { > [% INCLUDE 'header.inc' %] > [% INCLUDE 'acquisitions-search.inc' %] > >-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> › <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> › [% IF ( enter ) %][% IF ( booksellerid ) %] <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% name |html %]</a> › Update: [% name %][% ELSE %]Add vendor[% END %] [% ELSE %][% name |html %][% END %]</div> >+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> › <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> › [% IF ( enter ) %][% IF ( booksellerid ) %] <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% name |html %]</a> › Update: [% name |html %][% ELSE %]Add vendor[% END %] [% ELSE %][% name |html %][% END %]</div> > > <div id="doc3" class="yui-t2"> > >-- >2.7.4 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 19611
:
69099
|
69216
|
69472
|
69659