Summary: | XSS - patron-attr-types.tt, authorised_values.tt and categories.tt | ||
---|---|---|---|
Product: | Koha | Reporter: | Katrin Fischer <katrin.fischer> |
Component: | Architecture, internals, and plumbing | Assignee: | Katrin Fischer <katrin.fischer> |
Status: | CLOSED FIXED | QA Contact: | Marcel de Rooy <m.de.rooy> |
Severity: | major | ||
Priority: | P5 - low | CC: | amit.gupta, amitddng135, fridolin.somers, jonathan.druart, kyle, m.de.rooy, mtj, nick, tomascohen |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Small patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Bug Depends on: | 14568 | ||
Bug Blocks: | 19391 | ||
Attachments: |
Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt and categories.tt
Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt and categories.tt Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt and categories.tt Bug 19128: XSS - admin/authorised_values.tt |
Description
Katrin Fischer
2017-08-16 12:33:52 UTC
Created attachment 66090 [details] [review] Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt and categories.tt Preparation: - Add a branch with script in the branch name - Add a patron category with script in the category name - Add a new authorised value cateogory with script - Add a new authroised value for this category with script in all possible fields - Test editing patron categories - Test editing patron attribute types - Test viewing and editing authorised values Verify that with this script there is no more script executed and everything works fine. Created attachment 66136 [details] [review] Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt and categories.tt Preparation: - Add a branch with script in the branch name - Add a patron category with script in the category name - Add a new authorised value cateogory with script - Add a new authroised value for this category with script in all possible fields - Test editing patron categories - Test editing patron attribute types - Test viewing and editing authorised values Verify that with this script there is no more script executed and everything works fine. ******************************************** Works fine. Created attachment 66451 [details] [review] Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt and categories.tt Preparation: - Add a branch with script in the branch name - Add a patron category with script in the category name - Add a new authorised value cateogory with script - Add a new authroised value for this category with script in all possible fields - Test editing patron categories - Test editing patron attribute types - Test viewing and editing authorised values Verify that with this script there is no more script executed and everything works fine. Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Created attachment 67083 [details] [review] Bug 19128: XSS - admin/authorised_values.tt These patches have been pushed to 16.11.x and will be in 16.11.12. These patches have been pushed to 17.05.x and are in 17.05.04. Pushed to master for 17.11, thanks to everybody involved! Pushed to 16.05.x, for 16.05.17 release |