gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 16597: Fix XSS in opac-shareshelf 

To test
1/ Go to /cgi-bin/koha/opac-shareshelf.pl?op="><script>alert('XSS')</script>&shelfnumber=5
2/ Notice you see a js alert
3/ Apply patch
4/ It is gone

Reported by
Alex Middleton at Dionach

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit c47c835672)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
This commit is contained in:
Chris Cormack 2016-05-26 21:33:33 +12:00 committed by Julian Maurice
parent 5d1f6b08cc
commit 8d6486013b
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shareshelf.tt
View File

@ -32,7 +32,7 @@
<div id="shareshelf" class="maincontent">
[% IF errcode %]
[% IF errcode==1 && op %]<div class="alert">The operation [% op %] is not supported.</div>[% END %]
[% IF errcode==1 && op %]<div class="alert">The operation [% op | html %] is not supported.</div>[% END %]
[% IF errcode==1 && !op %]<div class="alert">No operation parameter has been passed.</div>[% END %]
[% IF errcode==2 %]<div class="alert">Invalid shelf number.</div>[% END %]
[% IF errcode==3 %]<div class="alert">The feature of sharing lists is not in use in this library.</div>[% END %]