gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 19034: XSS Flaws in Cities 

1. Hit /cgi-bin/koha/admin/cities.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search cities box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search cities box.
6. Notice it is no longer executed.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This commit is contained in:
Amit Gupta 2017-08-04 10:38:12 +05:30 committed by Jonathan Druart
parent e0dd566634
commit 3f7fc907ba
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
View File

@ -143,7 +143,7 @@
<h2>Cities</h2>
[% IF searchfield %]
Searching: [% searchfield %]
Searching: [% searchfield |html %]
[% END %]
[% IF cities.count %]