gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 19050 - XSS Flaws in Quick spine label creator 

1. Hit /cgi-bin/koha/labels/spinelabel-home.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> barcode text box.
3. Notice the iframe is executed
4. Apply patch
5. Reload page, and enter iframe again on barcode text box.
6. Notice it is no longer executed

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 18b6e1f5272ee4e2c4c1971a4346c1759df4b3d6)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This commit is contained in:
Amit Gupta 2017-08-07 20:49:56 +05:30 committed by Fridolin Somers
parent 0565a70c5c
commit 77a8be98a4
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt
View File

@ -23,7 +23,7 @@
</head>
[% IF ( BarcodeNotFound ) %]
<body id="labels_spinelabel-print" class="tools labels">
<p>The barcode [% Barcode %] was not found.</p>
<p>The barcode [% Barcode |html %] was not found.</p>
<p><a href="spinelabel-home.pl">Return to spine label printer</a></p>
</body>
[% ELSE %]