Created attachment 69473 [details] [review] Bug 19738: Fix XSS on vendor name in serials module Test plan: 1) do not apply this patch 2) Have at least one vendor which name does contain javascript, for example: <i>Vendor 1</i><script>alert('Hi');</script> 3) go to serial module and create new subscription 4) use "Search for vendor" 5) Search for your vendor, when search results table is presented, the javascript is executed 6) go through subscription creation and save the new subscription 7) On subscription detail page, the javascript is executed as well 8) apply this patch 9) Repeat 3-7, the script is not executed, the input is escaped
Created attachment 70165 [details] [review] Bug 19738: Fix XSS on vendor name in serials module Test plan: 1) do not apply this patch 2) Have at least one vendor which name does contain javascript, for example: <i>Vendor 1</i><script>alert('Hi');</script> 3) go to serial module and create new subscription 4) use "Search for vendor" 5) Search for your vendor, when search results table is presented, the javascript is executed 6) go through subscription creation and save the new subscription 7) On subscription detail page, the javascript is executed as well 8) apply this patch 9) Repeat 3-7, the script is not executed, the input is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2) Have at least one vendor which name does contain javascript, for example: <i>Vendor 1</i><script>alert('Hi');</script> LOL How many vendors are supposed to have javascript in their name ??
(In reply to Marcel de Rooy from comment #3) > 2) Have at least one vendor which name does contain javascript, for > example: <i>Vendor 1</i><script>alert('Hi');</script> > > LOL > How many vendors are supposed to have javascript in their name ?? Not many ;) but we want to be on the safe side... and if the vendor name does contain html code for examnple, we do not want to the name to be uncontrollably formatted...
Created attachment 70321 [details] [review] Bug 19738: Fix XSS on vendor name in serials module Test plan: 1) do not apply this patch 2) Have at least one vendor which name does contain javascript, for example: <i>Vendor 1</i><script>alert('Hi');</script> 3) go to serial module and create new subscription 4) use "Search for vendor" 5) Search for your vendor, when search results table is presented, the javascript is executed 6) go through subscription creation and save the new subscription 7) On subscription detail page, the javascript is executed as well 8) apply this patch 9) Repeat 3-7, the script is not executed, the input is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Patch pushed to * master for 18.05 * 17.11.x for v17.11.02 * 17.05.x for v17.05.08