gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 19108 - Stored XSS in oai_sets.pl 

To Test
1. Hit the page /cgi-bin/koha/admin/oai_sets.pl
2. Click on New set
3. Add a text in the field setSpec, setName that contains js
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Mason James <mtj@kohaaloha.com>
This commit is contained in:
Amit Gupta 2017-08-15 13:33:57 +05:30 committed by Mason James
parent 5a58f35afc
commit 75ca6a17ad
2 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt
View File

@ -56,7 +56,7 @@ function hideDialogBox() {
<p><a href="/cgi-bin/koha/admin/oai_sets.pl">Return to sets management</a></p>
</div>
[% END %]
<h1>Mappings for set '[% setName %]' ([% setSpec %])</h1>
<h1>Mappings for set '[% setName |html %]' ([% setSpec |html %])</h1>
[% UNLESS ( mappings ) %]
<div class="dialog alert"><p><strong>Warning:</strong> No mappings have been defined for this set</p></div>
[% END %]

10
koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt
View File

@ -45,7 +45,7 @@ $(document).ready(function() {
[% INCLUDE 'header.inc' %]
[% INCLUDE 'cat-search.inc' %]
<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo; [% IF ( op_new ) %]<a href="/cgi-bin/koha/admin/oai_sets.pl">OAI sets configuration</a> &rsaquo; Add a new OAI set[% ELSIF ( op_mod ) %]<a href="/cgi-bin/koha/admin/oai_sets.pl">OAI sets configuration</a> &rsaquo; Edit OAI set '[% spec %]'[% ELSE %] OAI sets configuration[% END %]</div>
<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo; [% IF ( op_new ) %]<a href="/cgi-bin/koha/admin/oai_sets.pl">OAI sets configuration</a> &rsaquo; Add a new OAI set[% ELSIF ( op_mod ) %]<a href="/cgi-bin/koha/admin/oai_sets.pl">OAI sets configuration</a> &rsaquo; Edit OAI set '[% spec |html %]'[% ELSE %] OAI sets configuration[% END %]</div>
<div id="doc3" class="yui-t2">
@ -58,7 +58,7 @@ $(document).ready(function() {
<h2>Add a new OAI set</h2>
<input type="hidden" name="op" value="savenew" />
[% ELSIF ( op_mod ) %]
<h2>Edit OAI set '[% spec %]'</h2>
<h2>Edit OAI set '[% spec |html %]'</h2>
<input type="hidden" name="op" value="savemod" />
<input type="hidden" name="id" value="[% id %]" />
[% END %]
@ -109,13 +109,13 @@ $(document).ready(function() {
<tbody>
[% FOREACH set IN sets_loop %]
<tr>
<td>[% set.spec %]</td>
<td>[% set.name %]</td>
<td>[% set.spec |html %]</td>
<td>[% set.name |html %]</td>
<td>
[% IF set.descriptions %]
<ul>
[% FOREACH desc IN set.descriptions %]
<li>[% desc.description %]</li>
<li>[% desc.description |html %]</li>
[% END %]
</ul>
[% ELSE %]