Summary: | XSS Flaws in supplier.pl | ||
---|---|---|---|
Product: | Koha | Reporter: | Amit Gupta <amitddng135> |
Component: | Architecture, internals, and plumbing | Assignee: | Amit Gupta <amitddng135> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | major | ||
Priority: | P5 - low | CC: | alex.arnaud, amit.gupta, amitddng135, chris, fridolin.somers, jonathan.druart, josef.moravec, julian.maurice, kyle, m.de.rooy, nick, tomascohen |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | Sponsored | Patch complexity: | Trivial patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Bug Depends on: | |||
Bug Blocks: | 14568, 19738 | ||
Attachments: |
Bug 19611 - XSS Flaws in supplier.pl
Bug 19611 - XSS Flaws in supplier.pl Bug 19611 - XSS Flaws in supplier.pl Bug 19611: Fix XSS Flaws in supplier.pl |
Description
Amit Gupta
2017-11-12 13:31:03 UTC
Created attachment 69099 [details] [review] Bug 19611 - XSS Flaws in supplier.pl Test 1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter 2. Add a text in the field Name that contains java script 3. Save the page. 4. Notice js is execute 5. Apply patch and reload the js is escaped Created attachment 69216 [details] [review] Bug 19611 - XSS Flaws in supplier.pl Test 1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter 2. Add a text in the field Name that contains java script 3. Save the page. 4. Notice js is execute 5. Apply patch and reload the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Awaits QA. Created attachment 69472 [details] [review] Bug 19611 - XSS Flaws in supplier.pl Test 1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter 2. Add a text in the field Name that contains java script 3. Save the page. 4. Notice js is execute 5. Apply patch and reload the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Josef Moravec <josef.moravec@gmail.com> Created attachment 69659 [details] [review] Bug 19611: Fix XSS Flaws in supplier.pl Test 1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter 2. Add a text in the field Name that contains java script 3. Save the page. 4. Notice js is execute 5. Apply patch and reload the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Josef Moravec <josef.moravec@gmail.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Pushed to 16.11.x will be in 16.11.15 Pushed to stable for 17.11.01 Pushed to 17.05.x for 17.05.07 Pushed to master for 18.05, thanks to everybody involved! |