gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 16878: Fix XSS in opac-memberentry 

The vars are gotten from the url and sent to the template as it. They
must be escaped.

Test plan:
I have not managed to create the original issue, so there is no test
plan for the XSS fix, but you can confirm there is no regression.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit 9bdea2e369)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
(cherry picked from commit b505c6b7d6)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
This commit is contained in:
Jonathan Druart 2016-07-22 08:30:54 +01:00 committed by Julian Maurice
parent a6d6b953e4
commit a503a522c2
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
opac/opac-memberentry.pl
View File

@ -20,7 +20,7 @@ use Modern::Perl;
use CGI qw ( -utf8 );
use Digest::MD5 qw( md5_base64 md5_hex );
use String::Random qw( random_string );
use HTML::Entities;
use C4::Auth;
use C4::Output;
use C4::Members;
@ -328,7 +328,7 @@ sub ParseCgiForBorrower {
foreach ( $cgi->param ) {
if ( $_ =~ '^borrower_' ) {
my ($key) = substr( $_, 9 );
$borrower{$key} = $scrubber->scrub( $cgi->param($_) );
$borrower{$key} = HTML::Entities::encode( $scrubber->scrub( $cgi->param($_) ) );
}
}