gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 17024: Fix XSS in tools/viewlog.pl 

Test plan:
    Hit /tools/viewlog.pl?do_it=1&modules=CATALOGUING&action=MODIFY&object=<script>alert("XSS")</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit f563ba795e)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
(cherry picked from commit 24664b719f)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
This commit is contained in:
Jonathan Druart 2016-08-02 14:32:46 +01:00 committed by Julian Maurice
parent 9b42a3f9b2
commit 1d44cd8225
2 changed files with 18 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
koha-tmpl/intranet-tmpl/prog/en/includes/biblio-view-menu.inc
View File

@ -3,36 +3,36 @@
<div id="menu">
<ul>
[% IF ( detailview ) %]<li class="active">[% ELSE %]<li>[% END %]
<a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio_object_id %]">Normal</a></li>
<a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio_object_id | url %]">Normal</a></li>
[% IF ( can_view_MARC ) %]
[% IF ( marcview ) %]<li class="active">[% ELSE %]<li>[% END %]
<a href="/cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=[% biblio_object_id %]">MARC</a></li>
<a href="/cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=[% biblio_object_id | url %]">MARC</a></li>
[% END %]
[% IF ( can_view_labeledMARC ) %]
[% IF ( labeledmarcview ) %]<li class="active">[% ELSE %]<li>[% END %]
<a href="/cgi-bin/koha/catalogue/labeledMARCdetail.pl?biblionumber=[% biblio_object_id %]">Labeled MARC</a></li>
<a href="/cgi-bin/koha/catalogue/labeledMARCdetail.pl?biblionumber=[% biblio_object_id | url %]">Labeled MARC</a></li>
[% END %]
[% IF ( can_view_ISBD ) %]
[% IF ( isbdview ) %]<li class="active">[% ELSE %]<li>[% END %]
<a href="/cgi-bin/koha/catalogue/ISBDdetail.pl?biblionumber=[% biblio_object_id %]">ISBD</a></li>
<a href="/cgi-bin/koha/catalogue/ISBDdetail.pl?biblionumber=[% biblio_object_id | url %]">ISBD</a></li>
[% END %]
[% IF ( moredetailview ) %]<li class="active">[% ELSE %]<li>[% END %]
<a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% biblio_object_id %]">Items</a></li>
<a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% biblio_object_id | url %]">Items</a></li>
[% IF ( CAN_user_reserveforothers ) %]
[% IF ( holdsview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% biblio_object_id %]">Holds ([% Biblio.HoldsCount( biblio_object_id ) %])</a></li>
[% IF ( holdsview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% biblio_object_id | url %]">Holds ([% Biblio.HoldsCount( biblio_object_id ) %])</a></li>
[% END %]
[% IF ( EasyAnalyticalRecords ) %][% IF ( analyze ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio_object_id %]&amp;analyze=1">Analytics</a></li>[% END %]
[% IF ( EasyAnalyticalRecords ) %][% IF ( analyze ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio_object_id | url %]&amp;analyze=1">Analytics</a></li>[% END %]
[% IF ( subscriptionsnumber ) %]<li><a href="/cgi-bin/koha/serials/serials-search.pl?searched=1&amp;biblionumber=[% biblio_object_id %]">Subscription(s)</a></li>[% END %]
[% IF ( subscriptionsnumber ) %]<li><a href="/cgi-bin/koha/serials/serials-search.pl?searched=1&amp;biblionumber=[% biblio_object_id | url %]">Subscription(s)</a></li>[% END %]
</ul>
<ul>
[% IF ( issuehistoryview ) %]<li class="active">[% ELSE %]<li>[% END %]
<a href="/cgi-bin/koha/catalogue/issuehistory.pl?biblionumber=[% biblio_object_id %]" >Checkout history</a></li>
[% IF ( CAN_user_tools_view_system_logs ) %][% IF ( logview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/tools/viewlog.pl?do_it=1&amp;modules=CATALOGUING&amp;action=MODIFY&amp;object=[% biblio_object_id %]">Modification log</a> </li>[% END %]
<a href="/cgi-bin/koha/catalogue/issuehistory.pl?biblionumber=[% biblio_object_id | url %]" >Checkout history</a></li>
[% IF ( CAN_user_tools_view_system_logs ) %][% IF ( logview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/tools/viewlog.pl?do_it=1&amp;modules=CATALOGUING&amp;action=MODIFY&amp;object=[% biblio_object_id | url %]">Modification log</a> </li>[% END %]
</ul>
</div>

16
koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt
View File

@ -69,12 +69,12 @@
[% IF ( do_it ) %]
<input type="hidden" name="do_it" value="[% do_it %]" />
[% END %]
<input type="hidden" name="src" value="[% src %]" />
<input type="hidden" name="src" value="[% src | html %]" />
<fieldset class="rows">
<ol>
<li>
<label for="user">Librarian:</label>
<input type="text" name="user" id="user" value="[% user %]" />
<input type="text" name="user" id="user" value="[% user | html %]" />
</li>
<li>
<label for="modules">Modules:</label>
@ -113,18 +113,18 @@
</li>
<li>
<label for="object">Object: </label>
<input type="text" id="object" name="object" value="[% object %]" />
<input type="text" id="object" name="object" value="[% object | html %]" />
</li>
<li>
<label for="info">Info:</label>
<input type="text" id="info" name="info" value="[% info %]" />
<input type="text" id="info" name="info" value="[% info | html %]" />
</li>
<li>
<label for="from"> Display from: </label> <input type="text" size="10" id="from" name="from" value="[% datefrom %]" class="datepickerfrom" />
<label for="from"> Display from: </label> <input type="text" size="10" id="from" name="from" value="[% datefrom | html %]" class="datepickerfrom" />
<div class="hint">[% INCLUDE 'date-format.inc' %]</div>
</li>
<li>
<label for="to">Display to: </label> <input size="10" id="to" name="to" type="text" value="[% dateto %]" class="datepickerto" />
<label for="to">Display to: </label> <input size="10" id="to" name="to" type="text" value="[% dateto | html %]" class="datepickerto" />
<div class="hint">[% INCLUDE 'date-format.inc' %]</div>
</li>
</ol>
@ -218,10 +218,10 @@
<div class="dialog alert">
No log found
[% IF ( CATALOGUING ) %]
for <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% object %]">Bibliographic record [% object %]</a>
for <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% object | url %]">Bibliographic record [% object | html %]</a>
[% END %]
[% IF ( MEMBERS ) %]
for <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% object %]">[% INCLUDE 'patron-title.inc' %]</a>
for <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% object | url %]">[% INCLUDE 'patron-title.inc' %]</a>
[% END %]
.
</div>