gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42252: Prevent XSS when deleting a list at the OPAC 

Test plan:
Create a list with name=<script>alert("booh!");</script>
Delete it at the OPAC

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Jonathan Druart 2026-04-03 09:15:12 +02:00 committed by Lucas Gass
parent f4e21f4199
commit 224ba4ab48
No known key found for this signature in database
GPG Key ID: 60B447398B0D36CA
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
View File

@ -1053,9 +1053,9 @@
var shelf_number = $(this).data("shelfnumber");
var is_shared = $(this).data("shared");
var count = $(this).data("count");
var message = "<p><em>" + shelf_name + "</em></p>";
var message = "<p><em>" + escape_str(shelf_name) + "</em></p>";
if( count ){
message += "<p>" + _("Items on this list:") + " <strong>" + count + "</strong></p>";
message += "<p>" + _("Items on this list:") + " <strong>" + escape_str(count) + "</strong></p>";
}
if( is_shared ){
message += "<p>" + _("This list is shared. Other users will lose access to it.") + "</p>";
@ -1072,7 +1072,7 @@
e.preventDefault();
var shelf_name = $(this).data("shelfname");
var shelf_number = $(this).data("shelfnumber");
confirmModal( shelf_name, _("Are you sure you want to remove sharing? You will no longer have access to the list."), _("Yes, remove sharing"), _("No, do not remove sharing"), function( result ){
confirmModal( escape_str(shelf_name), _("Are you sure you want to remove sharing? You will no longer have access to the list."), _("Yes, remove sharing"), _("No, do not remove sharing"), function( result ){
if( result ){
$("#unshare" + shelf_number ).submit();
}