From 912eadf0283901e5d67119d9991a39e719b29dec Mon Sep 17 00:00:00 2001 From: Josef Moravec Date: Sun, 3 Dec 2017 22:21:57 +0000 Subject: [PATCH] Bug 19738: Fix XSS on vendor name in serials module Content-Type: text/plain; charset=utf-8 Test plan: 1) do not apply this patch 2) Have at least one vendor which name does contain javascript, for example: Vendor 1 3) go to serial module and create new subscription 4) use "Search for vendor" 5) Search for your vendor, when search results table is presented, the javascript is executed 6) go through subscription creation and save the new subscription 7) On subscription detail page, the javascript is executed as well 8) apply this patch 9) Repeat 3-7, the script is not executed, the input is escaped Signed-off-by: Katrin Fischer Signed-off-by: Marcel de Rooy --- koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search-result.tt | 2 +- koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search-result.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search-result.tt index 3ee8266..e1dacd3 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search-result.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search-result.tt @@ -27,7 +27,7 @@ [% FOREACH loop_supplier IN loop_suppliers %] - [% loop_supplier.name %] + [% loop_supplier.name |html %] Choose [% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt index c9d0330..bb8ac3a 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt @@ -64,7 +64,7 @@
  1. Subscription ID: [% subscriptionid %]
  2. Librarian identity: [% librarian %]
  3. -
  4. Vendor: [% aqbooksellername %]
  5. +
  6. Vendor: [% aqbooksellername |html %]
  7. Biblio: [% bibliotitle %] ([% bibnum %])
  8. [% IF ( OPACBaseURL ) %]
  9. -- 2.1.4