gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 19738: Fix XSS on vendor name in serials module 

Test plan:

1) do not apply this patch
2) Have at least one vendor which name does contain javascript, for
example: <i>Vendor 1</i><script>alert('Hi');</script>
3) go to serial module and create new subscription
4) use "Search for vendor"
5) Search for your vendor, when search results table is presented, the
javascript is executed
6) go through subscription creation and save the new subscription
7) On subscription detail page, the javascript is executed as well
8) apply this patch
9) Repeat 3-7, the script is not executed, the input is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This commit is contained in:
Josef Moravec 2017-12-03 22:21:57 +00:00 committed by Fridolin Somers
parent 86e099803e
commit 8a20bfe5ea
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search-result.tt
View File

@ -42,7 +42,7 @@ $(document).ready(function(){
</tr>
[% FOREACH loop_supplier IN loop_suppliers %]
<tr>
<td>[% loop_supplier.name %]</td>
<td>[% loop_supplier.name |html %]</td>
<td><a class="btn btn-default btn-xs select_vendor" href="#" data-vendorid="[% loop_supplier.aqbooksellerid %]" data-vendorname="[% loop_supplier.name |html%]">Choose</a></td>
</tr>
[% END %]

2
koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt
View File

@ -87,7 +87,7 @@ $(document).ready(function() {
<ol>
<li><span class="label">Subscription ID: </span>[% subscriptionid %]</li>
<li><span class="label">Librarian identity:</span> [% librarian %]</li>
<li><span class="label">Vendor:</span> <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% aqbooksellerid %]">[% aqbooksellername %]</a></li>
<li><span class="label">Vendor:</span> <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% aqbooksellerid %]">[% aqbooksellername |html %]</a></li>
<li><span class="label">Biblio:</span> <a href="/cgi-bin/koha/catalogue/[% default_bib_view %].pl?biblionumber=[% bibnum %]">[% bibliotitle %]</a> <i>([% bibnum %])</i></li>
[% IF ( OPACBaseURL ) %]
<li>