| Summary: | [security] XXS on list name (on admin part) | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Sébastien Marie <semarie> |
| Component: | Templates | Assignee: | Sébastien Marie <semarie> |
| Status: | CLOSED FIXED | QA Contact: | Bugs List <koha-bugs> |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | chris, wizzyrea |
| Version: | 3.4 | ||
| Hardware: | All | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Bug Depends on: | |||
| Bug Blocks: | 7310 | ||
| Attachments: |
Proposed patch
Bug 6632 [Signed Off] add html filter to prevent XSS |
||
|
Description
Sébastien Marie
2011-07-26 09:28:52 UTC
Created attachment 4752 [details] [review] Proposed patch Here a patch for TT page in admin. 'html' filter was added to each 'shelvename'. Created attachment 4756 [details] [review] Bug 6632 [Signed Off] add html filter to prevent XSS The filter 'html' have been added on all occurences of shelvename, which come from user input. Bug confirmed, fix signed off. XSS fix, pushed |